CVE-2019-25734: Web-Dorado Contact Form Maker

Medium severity, CVSS 4.0. EPSS: 0.9% chance of exploitation in the next 30 days.

Contact Form by WD 1.13.1 contains a cross-site request forgery vulnerability combined with local file inclusion that allows unauthenticated attackers to include arbitrary files by exploiting unsanitized action parameters. Attackers can craft malicious forms targeting the admin-ajax.php endpoint with directory traversal sequences in the GET action parameter to load files via CSRF, bypassing authentication on vulnerable AJAX actions.

Affected products

• Web-Dorado Contact Form Maker: version 1.13.1 only

Published 2026-06-04. Last modified 2026-07-22.