CVE-2024-5808: 
WordPress vulnerability analysis and mitigation

The WP Ajax Contact Form WordPress plugin versions 2.2.2 and below contain a Cross-Site Request Forgery (CSRF) vulnerability that allows attackers to delete emails from the email list when an administrator is logged in (WPScan).

The vulnerability exists due to the plugin's lack of CSRF protection mechanisms when deleting emails from the email list. This security flaw has been assigned a CVSS score of 4.7 (medium) and is classified under CWE-352. The vulnerability falls under the OWASP Top 10 category A2: Broken Authentication and Session Management (WPScan).

If exploited, this vulnerability allows attackers to trick authenticated administrators into performing unauthorized email deletions from the contact form's email list through CSRF attacks (WPScan).

A proof of concept exists where an attacker can create an HTML page containing a form submission script that, when accessed by a logged-in administrator, will trigger the unauthorized email deletion (WPScan).

Currently, there is no known fix available for this vulnerability. Users of the WP Ajax Contact Form plugin should consider implementing additional security measures or exploring alternative contact form solutions (WPScan).