Input validation vulnerability in Contact Form Email 1.3.12

The Contact Form Email plugin for WordPress is a tool that is vulnerable to a type of attack called Cross-Site Request Forgery in versions up to and including 1.3.11. This means that someone who is not authenticated (not logged in) can modify the settings of the plugin and inject malicious JavaScript into the website. This can be done if the attacker can get a website administrator to click on a link they sent. The vulnerability is due to the lack of nonce validation on the ‘cp_cfte_rep_enable’ action. For versions lower than or equal to 1.1.4, the malicious JavaScript can be injected via the ‘cp_cfte_rep_message’ parameter.