Cyber Resilience

CVE-2026-40764

High

Published: 15 April 2026

Published
15 April 2026
Modified
22 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:L
EPSS Score 0.0010 1.1th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-40764 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 8.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 1.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2026-40764 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the Contact Form by WPForms WordPress plugin (wpforms-lite). This issue affects versions from n/a through 1.10.0.2. Published on 2026-04-15T11:16:36.773, it carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:L).

The vulnerability enables exploitation over the network by unauthenticated attackers with high attack complexity and no required user interaction, resulting in a scope change. Successful attacks can achieve high confidentiality impact, low integrity impact, and low availability impact.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/wpforms-lite/vulnerability/wordpress-contact-form-by-wpforms-plugin-1-10-0-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve documents the CSRF vulnerability in wpforms-lite version 1.10.0.2.

OWASP Top 10 for Web (2025)

A01:2025 Broken Access Control

EU & UK References

Vulnerability details

Cross-Site Request Forgery (CSRF) vulnerability in Syed Balkhi Contact Form by WPForms wpforms-lite allows Cross Site Request Forgery.This issue affects Contact Form by WPForms: from n/a through <= 1.10.0.2.

CWE(s)
CWE-352

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

CSRF vulnerability in public-facing WordPress plugin directly enables exploitation of a web application over the network (T1190).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-23467Shared CWE-352
CVE-2018-25170Shared CWE-352
CVE-2025-22336Shared CWE-352
CVE-2025-23821Shared CWE-352
CVE-2025-22582Shared CWE-352
CVE-2025-23639Shared CWE-352
CVE-2024-50858Shared CWE-352
CVE-2025-23558Shared CWE-352
CVE-2026-6455Shared CWE-352
CVE-2025-55044Shared CWE-352

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Directly remediates the CSRF vulnerability in WPForms Lite by identifying, reporting, and applying patches to affected versions up to 1.10.0.2.

SC-23 Session Authenticity good match
prevent

Protects the authenticity of communications sessions to prevent CSRF attacks that forge requests on behalf of authenticated users in the contact form.

SI-10 Information Input Validation good match
prevent

Validates information inputs such as CSRF tokens to block forged requests exploiting the vulnerability in the WPForms Lite plugin.

References