A critical, remotely exploitable vulnerability has been found in a popular WordPress plugin that allows users to easily customize every aspect of the contact forms they embed into their websites.