Contact Form by WD [CSRF ? LFI]
Plugin implements the following AJAX actions: manage_fm, get_stats, generete_csv, generete_xml, formmakerwdcaptcha, nopriv_formmakerwdcaptcha, formmakerwdmathcaptcha, nopriv_formmakerwdmathcaptcha, product_option, FormMakerEditCountryinPopup, FormMakerMapEditinPopup, FormMakerIpinfoinPopup, show_matrix, FormMakerSubmits, FormMakerSQLMapping, select_data_from_db, manage. All of them call the function form_maker_ajax_fmc. This function dynamicaly loads a file defined in $_GET['action'] or $_POST['action'] if the former is not defined. Because of the way WordPress defines the AJAX action a user could define the plugin action in the $_GET['action'] and AJAX action in $_POST['action']. Leveraging that and the fact that no sanitization is performed on the $_GET['action'], a malicious actor can perform a CSRF attack to load a file using directory traversal thus leading to Local File Inclusion vulnerability.
