WordPress Plugin Vulnerabilities

Contact Form Email < 1.3.64 - Missing Authorization

Description

The Contact Form Email plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.3.63. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized action.

Affects Plugins

Plugin icon
contact-form-to-email
Fixed in 1.3.64

References

CVE
CVE-2026-32483
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/4c44e858-7028-495e-b6c7-8b7712e00eaf

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Linh Nguyen (huli07)
Verified
No
WPVDB ID
ed7eb9a5-5232-4abb-8005-7c3463ee1298

Timeline

Publicly Published
2026-03-23 (about 3 months ago)
Added
2026-05-05 (about 1 month ago)
Last Updated
2026-05-05 (about 1 month ago)

Other

Published
Title
Published
2026-03-02
Title
VW Portfolio < 1.3.4 - Missing Authorization
Published
2025-04-01
Title
Publitio < 2.1.9 - Missing Authorization
Published
2026-01-05
Title
Appointment Booking and Scheduling Calendar Plugin – WP Timetics < 1.0.37 - Missing Authorization to Unauthenticated Booking Details View And Modification
Published
2026-01-08
Title
Attractive Donations System - Easy Stripe & Paypal donations <= 1.25 - Missing Authorization to Unauthenticated Arbitrary Content Deletion
Published
2025-08-14
Title
WP Membership < 1.6.4 - Missing Authorization to Authenticated (Subscriber+) Settings Update