{"summary":{"analyzed":true,"build_worthy":false,"build_worthy_family_key":"forms-leads","build_worthy_family_name":"lead capture reliability","build_worthy_reason":"This row is supporting evidence for the linked opportunity family; use the family card, not this row, for the build decision.","build_worthy_scope":"opportunity_family","comments_returned":2,"commercial_card_missing_count":0,"commercial_card_status":"complete","commercial_context_status":"linked_opportunity","commercial_context_status_label":"Evidence linked to opportunity","evidence_context_status":"linked_opportunity","evidence_context_status_label":"Evidence linked to opportunity","evidence_role":"supports_opportunity_family","evidence_role_label":"Evidence supporting opportunity family","evidence_role_reason":"This row is supporting evidence for the linked opportunity family; use the family card, not this row, for the build decision.","intelligence_role":"supporting_evidence","intelligence_role_label":"Supporting evidence","is_build_worthy":false,"opportunity_context_status":"linked_opportunity","opportunity_context_status_label":"Evidence linked to opportunity","opportunity_decision_status":"supporting_evidence","opportunity_decision_status_label":"Supporting evidence","opportunity_relevance":1.0,"plugin_name":"Contact Form by Supsystic","promotion_reason":"This row is supporting evidence linked to a commercial opportunity family, not the build-worthy opportunity itself.","promotion_status":"linked_opportunity","promotion_status_label":"Evidence linked to opportunity","recommendation_role":"evidence_input","recommendation_role_label":"Evidence input","reply_count":2,"row_is_build_worthy":false,"row_is_opportunity":false,"row_role":"supporting_evidence","row_role_label":"Supporting evidence","sentiment":"complaint","severity":"high","slug":"contact-form-by-supsystic","source":"support","source_link_count":2,"url":"https://wordpress.org/support/topic/cross-site-request-forgery-vulnerability/","worth_validating":false,"source_count":0,"source_evidence_summary":{"total":36,"source_evidence_rows":7,"source_link_rows":7,"source_count_only_rows":0,"missing_source_evidence_rows":29,"source_evidence_not_applicable_rows":0,"source_link_coverage_percent":19.4,"evidence_required_rows":0,"evidence_required_rows_missing_source_links":0,"build_worthy_rows_missing_source_links":0,"decision_rows_missing_source_links":0,"missing_source_examples":[]},"commercial_readiness":{"total":36,"validation_ready":0,"core_validation_ready_rows":0,"family_wide_validation_ready_rows":0,"core_only_validation_ready_rows":0,"validation_scope_status":"not_ready","validation_scope_label":"Not ready","validation_scope_warning":"","validation_scope_counts":[{"scope":"not_validation_ready","label":"Not validation-ready","count":36}],"blocker_count":70,"caution_count":0,"status_counts":[{"status":"needs_external_proof","label":"Needs outside proof","count":35},{"status":"needs_family_proof","label":"Needs family proof","count":1}],"blocker_counts":[{"label":"Outside proof needed: not validated","count":35},{"label":"Commercial gate not complete: proof blocked","count":35}],"caution_counts":[],"ready_for_buyer_validation":0,"needs_external_proof":35,"needs_family_proof":1,"needs_report":0,"needs_thesis_detail":0,"needs_thesis_sharpening":0,"research_first":0,"research_only":0,"hold":0,"unclassified":0,"core_wedge_validation_ready_rows":0,"full_family_validation_ready_rows":0,"scope_limited_validation_rows":0,"full_family_claim_ready_rows":0,"validation_claim_scope_policy":"Core-only validation rows are worth buyer testing, but they must not be presented as full-family commercial opportunities until family_wide_validation_ready is true."},"commercial_readiness_summary":{"status":"needs_family_proof","label":"Needs family proof","validation_ready":false,"family_key":"forms-leads","family_name":"lead capture reliability","decision_bucket":"proof_blocked","decision_bucket_label":"Proof Blocked","proof_status":"validated_core","proof_status_label":"Validated core","commercial_gate_status":"complete","commercial_gate_label":"Gate complete","commercial_gate_passed":7,"commercial_gate_total":7,"commercial_card_status":"complete","commercial_card_complete":true,"commercial_card_missing_count":0,"blockers":[],"blocker_count":0,"cautions":[],"caution_count":0,"next_action":"Finish the missing outside proof, then test buyer urgency with lead-generation site owners: monitor contact forms submissions, notification delivery, spam, and CRM handoffs.","dossier_url":"/opportunities/families/forms-leads/dossier","dossier_api_url":"/api/opportunities/families/forms-leads/dossier"},"readiness_summary":{"status":"needs_family_proof","label":"Needs family proof","validation_ready":false,"family_key":"forms-leads","family_name":"lead capture reliability","decision_bucket":"proof_blocked","decision_bucket_label":"Proof Blocked","proof_status":"validated_core","proof_status_label":"Validated core","commercial_gate_status":"complete","commercial_gate_label":"Gate complete","commercial_gate_passed":7,"commercial_gate_total":7,"commercial_card_status":"complete","commercial_card_complete":true,"commercial_card_missing_count":0,"blockers":[],"blocker_count":0,"cautions":[],"caution_count":0,"next_action":"Finish the missing outside proof, then test buyer urgency with lead-generation site owners: monitor contact forms submissions, notification delivery, spam, and CRM handoffs.","dossier_url":"/opportunities/families/forms-leads/dossier","dossier_api_url":"/api/opportunities/families/forms-leads/dossier"},"cache_source":"durable_stale","cache_age_seconds":10467,"payload_mode":"compact","full_payload_url":"/api/evidence/source?full=true&compact_schema=evidence-source-v2&url=https%3A//wordpress.org/support/topic/cross-site-request-forgery-vulnerability/&comment_limit=80&text_limit=12000","row_key":"rows","source_row_key":"rows","rows_shown":1,"comments_shown":2,"evidence_summary":{"total":1,"source_evidence_rows":0,"source_link_rows":1,"source_count_only_rows":0,"missing_source_evidence_rows":0,"source_evidence_not_applicable_rows":0,"source_link_coverage_percent":100.0,"evidence_required_rows":0,"evidence_required_rows_missing_source_links":0,"build_worthy_rows_missing_source_links":0,"decision_rows_missing_source_links":0,"missing_source_examples":[]}},"rows":[{"section":"source","row_type":"source","url":"https://wordpress.org/support/topic/cross-site-request-forgery-vulnerability/","slug":"contact-form-by-supsystic","plugin_name":"Contact Form by Supsystic","source":"support","sentiment":"complaint","severity":"high","opportunity_relevance":1.0,"reply_count":2,"comments_returned":2,"analyzed":true,"source_link_count":2,"title":"Cross-Site Request Forgery Vulnerability","author":"geekwap","published_at":"2024-01-29T18:39:00+00:00","resolved":false,"collected_at":"2026-07-07T05:03:02+00:00","intent":"feature_request","affected_feature":"form","summary":"Cross-Site Request Forgery Vulnerability: users show security, bugs, missing feature pain that may indicate a product gap.","evidence_quote":"Cross-Site Request Forgery Vulnerability Hello, Wordfence found this vulnerability: The Contact Form by Supsystic plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.27.","confidence":0.68,"analyzed_at":"2026-07-07T05:03:25+00:00","market_key":"contact forms","market_name":"Contact Forms","market_url":"/markets/contact%20forms","opportunity_url":"/opportunities/contact%20forms","family_key":"forms-leads","family_name":"lead capture reliability","opportunity_family_key":"forms-leads","opportunity_family_name":"lead capture reliability","buyer":"marketing teams, agencies, and lead-generation site owners","what_to_build":"Contact Forms lead-capture reliability for protecting form submissions and lead routing","urgent_problem":"Businesses lose leads when forms, spam controls, email delivery, or CRM handoffs fail.","problem":"Businesses lose leads when forms, spam controls, email delivery, or CRM handoffs fail.","competitor_gap":"Gap to test: can buyers monitor contact forms submissions, notification delivery, spam, and CRM handoffs before lead capture, delivery, or CRM handoff risk. pain: lost-lead and notification failure risk (12 signals), spam, abuse, or deliverability risk (6 signals)....","proof_support":"Proof base: outside proof that buyers already pay around the workflow, paid-adjacent plugin or pricing signals, repeated WordPress pain, and weak incumbent coverage around protecting form submissions and lead routing.","needs_validation":"finish the missing outside proof, then test buyer urgency with lead-generation site owners: monitor contact forms submissions, notification delivery, spam, and CRM handoffs.","what_still_needs_validation":"finish the missing outside proof, then test buyer urgency with lead-generation site owners: monitor contact forms submissions, notification delivery, spam, and CRM handoffs.","commercial_attractiveness":"Commercial pull comes from lead-generation site owners: businesses lose leads when forms, spam controls, email delivery, or CRM handoffs fail. The first paid wedge is to monitor contact forms submissions, notification delivery, spam, and CRM handoffs. Revenue can come from...","first_validation_wedge":"monitor contact forms submissions, notification delivery, spam, and CRM handoffs","mvp_wedge":"monitor contact forms submissions, notification delivery, spam, and CRM handoffs","decision_bucket":"proof_blocked","decision_bucket_label":"Proof Blocked","row_role":"supporting_evidence","recommendation_role":"evidence_input","evidence_role":"supports_opportunity_family","promotion_status":"linked_opportunity","promotion_status_label":"Evidence linked to opportunity","promotion_reason":"This row is supporting evidence linked to a commercial opportunity family, not the build-worthy opportunity itself.","is_build_worthy":false,"worth_validating":false,"build_worthy_scope":"opportunity_family","build_worthy_family_key":"forms-leads","opportunity_decision_status":"supporting_evidence","body_summary":"Hello, Wordfence found this vulnerability: The Contact Form by Supsystic plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.27. This is due to missing nonce...","issue_labels":["security","bugs","missing feature","support"],"source_links":[{"source_url":"https://wordpress.org/support/topic/cross-site-request-forgery-vulnerability/","url":"https://wordpress.org/support/topic/cross-site-request-forgery-vulnerability/","original_url":"https://wordpress.org/support/topic/cross-site-request-forgery-vulnerability/","source_page_url":"/evidence/source?url=https%3A%2F%2Fwordpress.org%2Fsupport%2Ftopic%2Fcross-site-request-forgery-vulnerability%2F","source_api_url":"/api/evidence/source?url=https%3A%2F%2Fwordpress.org%2Fsupport%2Ftopic%2Fcross-site-request-forgery-vulnerability%2F"}]}],"plugin":{"active_installs":6000,"api_url":"/api/plugins/contact-form-by-supsystic","downloaded":644887,"name":"Contact Form by Supsystic","rating":94.0,"slug":"contact-form-by-supsystic","tags":["contact form","contact form builder","contact form manager","contact form plugin","contact forms"],"url":"/plugin/contact-form-by-supsystic"},"conversation":{"url":"https://wordpress.org/support/topic/cross-site-request-forgery-vulnerability/","slug":"contact-form-by-supsystic","source":"support","title":"Cross-Site Request Forgery Vulnerability","author":"geekwap","published_at":"2024-01-29T18:39:00+00:00","resolved":false,"reply_count":2,"collected_at":"2026-07-07T05:03:02+00:00","body_summary":"Hello, Wordfence found this vulnerability: The Contact Form by Supsystic plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.27. This is due to missing nonce validation on an unknown function. This makes it possible for..."},"analysis":{"affected_feature":"form","analyzed_at":"2026-07-07T05:03:25+00:00","complaint_types":["security","bugs","missing_feature","support"],"confidence":0.68,"conversation_url":"https://wordpress.org/support/topic/cross-site-request-forgery-vulnerability/","evidence_quote":"Cross-Site Request Forgery Vulnerability Hello, Wordfence found this vulnerability: The Contact Form by Supsystic plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.27.","intent":"feature_request","issue_labels":["security","bugs","missing feature","support"],"model":"heuristic-v1","opportunity_relevance":1.0,"praise_types":[],"sentiment":"complaint","severity":"high","slug":"contact-form-by-supsystic","source":"support","summary":"Cross-Site Request Forgery Vulnerability: users show security, bugs, missing feature pain that may indicate a product gap."},"comments":[{"position":1,"author":"Ed N.","published_at":"2024-03-26T16:10:00+00:00","body_summary":"We are getting notice of the Cross Site Request Forgery (CSRF) vulnerability as well. Please update this as soon as possible."},{"position":2,"author":"gruntlord6","published_at":"2024-05-09T17:10:00+00:00","body_summary":"Any ETA on fixing this? Its been an issue for months https://www.cve.org/CVERecord?id=CVE-2023-45068 This reply was modified 2 years, 1 month ago by gruntlord6 ."}],"source_links":[{"source_url":"https://wordpress.org/support/topic/cross-site-request-forgery-vulnerability/","url":"https://wordpress.org/support/topic/cross-site-request-forgery-vulnerability/","original_url":"https://wordpress.org/support/topic/cross-site-request-forgery-vulnerability/","source_page_url":"/evidence/source?url=https%3A%2F%2Fwordpress.org%2Fsupport%2Ftopic%2Fcross-site-request-forgery-vulnerability%2F","source_api_url":"/api/evidence/source?url=https%3A%2F%2Fwordpress.org%2Fsupport%2Ftopic%2Fcross-site-request-forgery-vulnerability%2F"},{"source_url":"https://wordpress.org/plugins/contact-form-by-supsystic/","url":"https://wordpress.org/plugins/contact-form-by-supsystic/","original_url":"https://wordpress.org/plugins/contact-form-by-supsystic/","source_page_url":"/plugin/contact-form-by-supsystic","source_api_url":"/api/plugins/contact-form-by-supsystic"}],"source_link_count":2,"market_key":"contact forms","market_name":"Contact Forms","market_url":"/markets/contact%20forms","opportunity_url":"/opportunities/contact%20forms","opportunity_card":{"key":"forms-leads","name":"lead capture reliability","family_key":"forms-leads","family_name":"lead capture reliability","family_label":"lead capture reliability","display_name":"Contact Forms lead-capture reliability","opportunity_name":"Contact Forms lead-capture reliability","opportunity_label":"Contact Forms lead-capture reliability","decision_bucket":"proof_blocked","commercial_readiness_status":"needs_family_proof","commercial_readiness_label":"Needs family proof","validation_ready":false,"is_build_worthy":false,"row_role":"opportunity_family","recommendation_role":"commercial_opportunity_candidate","buyer":"marketing teams, agencies, and lead-generation site owners","who_buys":"marketing teams, agencies, and lead-generation site owners","primary_buyer_segment":"lead-generation site owners","urgent_problem":"Businesses lose leads when forms, spam controls, email delivery, or CRM handoffs fail.","problem":"Businesses lose leads when forms, spam controls, email delivery, or CRM handoffs fail.","pain":"Businesses lose leads when forms, spam controls, email delivery, or CRM handoffs fail.","what_to_build":"Contact Forms lead-capture reliability for protecting form submissions and lead routing","first_validation_wedge":"monitor contact forms submissions, notification delivery, spam, and CRM handoffs","mvp_wedge":"monitor contact forms submissions, notification delivery, spam, and CRM handoffs","wedge":"monitor contact forms submissions, notification delivery, spam, and CRM handoffs","source_count":12,"source_link_count":12,"next_action":"Finish the missing outside proof, then test buyer urgency with lead-generation site owners: monitor contact forms submissions, notification delivery, spam, and CRM handoffs.","family_dossier_url":"/opportunities/families/forms-leads/dossier","opportunity_family_dossier_url":"/opportunities/families/forms-leads/dossier","family_dossier_api_url":"/api/opportunities/families/forms-leads/dossier","opportunity_family_dossier_api_url":"/api/opportunities/families/forms-leads/dossier","urls":{"dossier":"/opportunities/families/forms-leads/dossier","family":"/opportunities?family=forms-leads"},"api_urls":{"dossier":"/api/opportunities/families/forms-leads/dossier","family":"/api/opportunities/families?family=forms-leads"},"family_url":"/opportunities?family=forms-leads","opportunity_family_url":"/opportunities?family=forms-leads","opportunity_family_api_url":"/api/opportunities/families?family=forms-leads","commercial_gate_status":"complete","commercial_gate_label":"Gate complete","commercial_card_status":"complete","commercial_card_missing_count":0},"commercial_card_summary":{"status":"complete","status_label":"complete","missing_count":0,"passed":9,"required":9,"summary":{}},"commercial_card_checklist":[{"key":"what_to_build","label":"What to build","passed":true,"status":"pass","detail":"Contact Forms lead-capture reliability for protecting form submissions and lead routing"},{"key":"specific_buyer","label":"Specific buyer","passed":true,"status":"pass","detail":"marketing teams, agencies, and lead-generation site owners"},{"key":"urgent_problem","label":"Urgent problem","passed":true,"status":"pass","detail":"Businesses lose leads when forms, spam controls, email delivery, or CRM handoffs fail."},{"key":"competitor_gap","label":"Competitor gap","passed":true,"status":"pass","detail":"Gap to test: can buyers monitor contact forms submissions, notification delivery, spam, and CRM handoffs before lead capture, delivery, or CRM handoff risk. pain: lost-lead and notification failure risk (12 signals), spa"}],"family_key":"forms-leads","family_name":"lead capture reliability","opportunity_family_key":"forms-leads","opportunity_family_name":"lead capture reliability","buyer":"marketing teams, agencies, and lead-generation site owners","what_to_build":"Contact Forms lead-capture reliability for protecting form submissions and lead routing","urgent_problem":"Businesses lose leads when forms, spam controls, email delivery, or CRM handoffs fail.","problem":"Businesses lose leads when forms, spam controls, email delivery, or CRM handoffs fail.","competitor_gap":"Gap to test: can buyers monitor contact forms submissions, notification delivery, spam, and CRM handoffs before lead capture, delivery, or CRM handoff risk. pain: lost-lead and notification failure risk (12 signals), spam, abuse, or deliverability risk (6 signals). weak-incumbent evidence gives 16 teardown signal(s). Entry wedge: monitor contact forms submissions, notification delivery, spam, and CRM handoffs.","proof_support":"Proof base: outside proof that buyers already pay around the workflow, paid-adjacent plugin or pricing signals, repeated WordPress pain, and weak incumbent coverage around protecting form submissions and lead routing.","needs_validation":"finish the missing outside proof, then test buyer urgency with lead-generation site owners: monitor contact forms submissions, notification delivery, spam, and CRM handoffs.","what_still_needs_validation":"finish the missing outside proof, then test buyer urgency with lead-generation site owners: monitor contact forms submissions, notification delivery, spam, and CRM handoffs.","commercial_attractiveness":"Commercial pull comes from lead-generation site owners: businesses lose leads when forms, spam controls, email delivery, or CRM handoffs fail. The first paid wedge is to monitor contact forms submissions, notification delivery, spam, and CRM handoffs. Revenue can come from submission monitoring, CRM/email integrations, spam analysis, alerts, and client reporting.","first_validation_wedge":"monitor contact forms submissions, notification delivery, spam, and CRM handoffs","mvp_wedge":"monitor contact forms submissions, notification delivery, spam, and CRM handoffs","decision_bucket":"proof_blocked","decision_bucket_label":"Proof Blocked","api_urls":{"evidence":"/api/evidence?slug=contact-form-by-supsystic","market":"/markets/contact%20forms","opportunity":"/opportunities/contact%20forms","plugin":"/api/plugins/contact-form-by-supsystic","source":"/api/evidence/source?url=https%3A%2F%2Fwordpress.org%2Fsupport%2Ftopic%2Fcross-site-request-forgery-vulnerability%2F","wordpress":"https://wordpress.org/support/topic/cross-site-request-forgery-vulnerability/","family":"/api/opportunities/families?family=forms-leads","dossier":"/api/opportunities/families/forms-leads/dossier"},"commercial_readiness":{"total":36,"validation_ready":0,"core_validation_ready_rows":0,"family_wide_validation_ready_rows":0,"core_only_validation_ready_rows":0,"validation_scope_status":"not_ready","validation_scope_label":"Not ready","validation_scope_warning":"","validation_scope_counts":[{"scope":"not_validation_ready","label":"Not validation-ready","count":36}],"blocker_count":70,"caution_count":0,"status_counts":[{"status":"needs_external_proof","label":"Needs outside proof","count":35},{"status":"needs_family_proof","label":"Needs family proof","count":1}],"blocker_counts":[{"label":"Outside proof needed: not validated","count":35},{"label":"Commercial gate not complete: proof blocked","count":35}],"caution_counts":[],"ready_for_buyer_validation":0,"needs_external_proof":35,"needs_family_proof":1,"needs_report":0,"needs_thesis_detail":0,"needs_thesis_sharpening":0,"research_first":0,"research_only":0,"hold":0,"unclassified":0,"core_wedge_validation_ready_rows":0,"full_family_validation_ready_rows":0,"scope_limited_validation_rows":0,"full_family_claim_ready_rows":0,"validation_claim_scope_policy":"Core-only validation rows are worth buyer testing, but they must not be presented as full-family commercial opportunities until family_wide_validation_ready is true."},"readiness_summary":{"total":36,"validation_ready":0,"core_validation_ready_rows":0,"family_wide_validation_ready_rows":0,"core_only_validation_ready_rows":0,"validation_scope_status":"not_ready","validation_scope_label":"Not ready","validation_scope_warning":"","validation_scope_counts":[{"scope":"not_validation_ready","label":"Not validation-ready","count":36}],"blocker_count":70,"caution_count":0,"status_counts":[{"status":"needs_external_proof","label":"Needs outside proof","count":35},{"status":"needs_family_proof","label":"Needs family proof","count":1}],"blocker_counts":[{"label":"Outside proof needed: not validated","count":35},{"label":"Commercial gate not complete: proof blocked","count":35}],"caution_counts":[],"ready_for_buyer_validation":0,"needs_external_proof":35,"needs_family_proof":1,"needs_report":0,"needs_thesis_detail":0,"needs_thesis_sharpening":0,"research_first":0,"research_only":0,"hold":0,"unclassified":0,"core_wedge_validation_ready_rows":0,"full_family_validation_ready_rows":0,"scope_limited_validation_rows":0,"full_family_claim_ready_rows":0,"validation_claim_scope_policy":"Core-only validation rows are worth buyer testing, but they must not be presented as full-family commercial opportunities until family_wide_validation_ready is true."},"evidence_summary":{"total":1,"source_evidence_rows":0,"source_link_rows":1,"source_count_only_rows":0,"missing_source_evidence_rows":0,"source_evidence_not_applicable_rows":0,"source_link_coverage_percent":100.0,"evidence_required_rows":0,"evidence_required_rows_missing_source_links":0,"build_worthy_rows_missing_source_links":0,"decision_rows_missing_source_links":0,"missing_source_examples":[]},"cache":{"source":"durable_stale","generated_at":"2026-08-05T13:00:40+00:00","age_seconds":10467},"row_role":"supporting_evidence","recommendation_role":"evidence_input","evidence_role":"supports_opportunity_family","promotion_status":"linked_opportunity","promotion_status_label":"Evidence linked to opportunity","promotion_reason":"This row is supporting evidence linked to a commercial opportunity family, not the build-worthy opportunity itself.","is_build_worthy":false,"worth_validating":false,"build_worthy_scope":"opportunity_family","build_worthy_family_key":"forms-leads","opportunity_decision_status":"supporting_evidence"}