123ContactForm for WordPress <= 1.5.6 - Validation Bypass via Plugin Verification

The cfp-connect AJAX call uses user input controlled data to perform the signature verification, attackers could craft these values ($message, $signature, $cf_pub_key) to bypass the validation mechanisms and inject their own public_key into the database.