CVE-2026-39436

HighCVSS 7.1

Published: 25/05/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.13%

3th percentile - higher than 3% of all known CVEs

Summary

The CformsII WordPress plugin is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to 15.1.3. An attacker can trick an administrator into performing unwanted actions.

Risk Assessment

An attacker can force an administrator to change form settings or perform other operations without consent.

Recommendation

Update the CformsII plugin to the latest version or apply other CSRF protections.

Other vulnerabilities in CformsII

CVE-2026-39435High
Versions of CformsII up to 15.1.3 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious JavaScript code.

Original NVD description (English source)

Cross-Site Request Forgery (CSRF) vulnerability in bgermann CformsII allows Cross Site Request Forgery. This issue affects CformsII: from n/a through 15.1.3.