The WebDorado Contact Form Builder plugin before 1.0.69 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter with resultant local file inclusion via directory traversal because there can be a discrepancy between the $_POST'action' value and the $_GET'action' value and the latter is unsanitized.