PT-2025-51996 · Codepeople · Contact Form Email

Rooting · Published 2025-12-18 · Updated 2025-12-20 · CVE-2025-10019

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions codepeople Contact Form Email versions through 1.3.60

Description An authorization bypass exists in codepeople Contact Form Email due to incorrectly configured access control security levels. This allows exploitation through a user-controlled key.

Recommendations Update codepeople Contact Form Email to a version later than 1.3.60.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2025-10019

Affected Products

Contact Form Email

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-10019 · Security Note
• https://patchstack.com/database/Wordpress/Plugin/contact-form-to-email/vulnerability/wordpress-contact-form-email-plugin-1-3-59-insecure-direct-object-references-idor-vulnerability?_s_id=cve · Note
• https://twitter.com/CVEnew/status/2002466822965080323 · Twitter Post
• https://vdp.patchstack.com/database/Wordpress/Plugin/contact-form-to-email/vulnerability/wordpress-contact-form-email-plugin-1-3-59-insecure-direct-object-references-idor-vulnerability?_s_id=cve · Note