CVE-2023-35051 is a missing authorization flaw in the Contact Forms by Cimatti WordPress plugin, scored 5.4 Medium. The record lists versions through 1.5.7 as affected, and a low privilege login is needed. I could not confirm a fixed version, so check the changelog.
What's affected
The record says the issue affects Contact Forms by Cimatti from an unspecified first version through 1.5.7. The Patchstack entry the record points to could not be fetched here. No fixed version is named in the record.
The record's vector shows a network attack that needs a low privilege account, with low integrity and low availability impact and no effect on confidentiality. That means a logged in user with a basic role, such as a subscriber, is the likely attacker, so open registration raises the risk.
How to check if you're exposed
Check the installed plugin version in the WordPress admin under Plugins, or from the command line with WP-CLI:
wp plugin list
wp plugin get contact-forms --field=version
If the version is at or below the last affected release in the record, treat the site as exposed until you confirm a fixed release. Also check your update log and any staging or multisite installs, since plugins are often forgotten on secondary sites.
What to do now
- Open the plugin's changelog in the WordPress directory or the vendor's site and find the release that fixes this issue. I could not confirm one, so do not skip this step.
- Update the plugin to the latest release, after a backup and a test on staging.
- If the plugin is unused, deactivate and delete it.
- Review site roles, and remove accounts that do not need to exist.
- Turn on automatic plugin updates where you can accept the risk of unattended changes.
Why it matters
Missing authorization means the plugin checks that a user is logged in, or nothing, but not whether their role allows the action. The record's description says it allows exploiting incorrectly configured access control security levels.
The score is medium because the attacker needs an account and the impact is small. On sites with open registration, accounts cost nothing, so the practical difference between this and an unauthenticated flaw can be small.
The weakness classes involved are CWE-862 (Missing Authorization). The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog, and none of the advisories I read says it is exploited in the wild. That can change, so treat the status as a snapshot.
Severity and versions come from the record alone. I could not read the Patchstack page, so I cannot say whether it agrees. The record names no fixed version.
Quick check
Who can exploit it?
The record's vector requires a low privilege account, so a registered user with a basic role.
Is there a fixed version?
I could not confirm one. Read the plugin's changelog.
Sources
Last reviewed: 19 October 2026.
