CVE-2026-40764
Published: 15 April 2026
Summary
CVE-2026-40764 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 4.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the CSRF vulnerability in WPForms Lite by identifying, reporting, and applying patches to affected versions up to 1.10.0.2.
Protects the authenticity of communications sessions to prevent CSRF attacks that forge requests on behalf of authenticated users in the contact form.
Validates information inputs such as CSRF tokens to block forged requests exploiting the vulnerability in the WPForms Lite plugin.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CSRF vulnerability in public-facing WordPress plugin directly enables exploitation of a web application over the network (T1190).
NVD Description
Cross-Site Request Forgery (CSRF) vulnerability in Syed Balkhi Contact Form by WPForms wpforms-lite allows Cross Site Request Forgery.This issue affects Contact Form by WPForms: from n/a through <= 1.10.0.2.
Deeper analysisAI
CVE-2026-40764 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the Contact Form by WPForms WordPress plugin (wpforms-lite). This issue affects versions from n/a through 1.10.0.2. Published on 2026-04-15T11:16:36.773, it carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:L).
The vulnerability enables exploitation over the network by unauthenticated attackers with high attack complexity and no required user interaction, resulting in a scope change. Successful attacks can achieve high confidentiality impact, low integrity impact, and low availability impact.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/wpforms-lite/vulnerability/wordpress-contact-form-by-wpforms-plugin-1-10-0-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve documents the CSRF vulnerability in wpforms-lite version 1.10.0.2.
Details
- CWE(s)