Professional Contact Form WordPress Plugin Cross-Site Request Forgery Vulnerability

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the Professional Contact Form plugin for WordPress, affecting all versions through 1.0.0. The issue arises from inadequate nonce validation in the 'watch_for_contact_form_submit' function, allowing unauthenticated attackers to send test emails by tricking a site administrator into clicking a link.

Impact

Exploitation of this vulnerability allows for Cross-Site Request Forgery, where an attacker can send test emails on behalf of an administrator without their consent.

Reproduction

To reproduce this vulnerability, an attacker must send a forged request to the WordPress site running the affected plugin version. This request should be crafted to exploit the missing nonce validation in the 'watch_for_contact_form_submit' function. The attacker must then trick an administrator into clicking a link that activates the forged request, which will trigger the plugin to send a test email.