Contact Form by BestWebSoft – Advanced WP Contact Form Builder for WordPress

4.3.5 has a major vulnerability that needs to be fixed asap!

WP Engine summary of the vulnerability: This vulnerability allows any unauthenticated user to perform actions that only an administrator should be allowed to do. This vulnerability’s information has been verified by Patchstack. Please note that questions related to this notification should be directed to Patchstack, the plugin author or the 3rd-party researcher for the most accurate information. Resources providing further information on this vulnerability: patchstack.com/database/vulnerability/contact-form-plugin/wordpress-contact-form-by-bestwebsoft-plugin-4-3-5-broken-access-control-vulnerability?_a_id=473

Magnificent plugin, and works great.

I’ve been happily using the free version of this plug-in for many years and had been very pleased with it — thank you BestWesbSoft.

But a recent update meant it was un-useable for my customers. I raised a support issue, was then asked questions, which I immediately answered…and then nothing. No fix, no reply, just silence.

This app worked great, untill something went wrong and it stopped work. People cant send me a messages, they see in red “the message cant be send”. I don`t know what happened.

Then I triend to change some setting and it started working again, but I didnt see the messages in the text box. I decided to write the support team. They asked me for an acces to my admin wordpress panel and for ftp acces and I gave them the passords. They found and solve the problem fast. The support was great! Now I highly reccomend this plugin!

• This topic was modified 3 years, 2 months ago by gaburata.

A PHP session was created by a session_start() function call. This interferes with REST API and loopback requests. The session should be closed by session_write_close() before making any HTTP requests.