PT-2025-47442 · WordPress · Sureforms

Publicado 2025-11-19 · Atualizado 2025-11-19 · CVE-2025-12535

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions SureForms plugin for WordPress versions up to and including 1.13.1

Description The SureForms plugin for WordPress is susceptible to a Cross-Site Request Forgery Bypass. This occurs because the plugin uses generic WordPress REST API nonces (wp rest) for unauthenticated users through the 'wp ajax nopriv rest-nonce' action, instead of form-specific nonces. This allows unauthenticated attackers to bypass CSRF protection on REST API endpoints that rely only on nonce verification without further authentication checks. Attackers can then trigger unauthorized actions, including the plugin’s post-submission hooks and potentially REST endpoints of other plugins.

Recommendations Update the SureForms plugin to a version newer than 1.13.1.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2025-12535

Produtos afetados

Sureforms

Referências · 9

• https://twitter.com/VulmonFeeds/status/1991056249815794025 · Publicação no Twitter
• https://twitter.com/CVEnew/status/1991042905176191173 · Publicação no Twitter
• https://plugins.trac.wordpress.org/browser/sureforms/tags/1.13.1/inc/admin-ajax.php#L45 · Nota
• https://plugins.trac.wordpress.org/browser/sureforms/tags/1.13.1/inc/background-process.php#L74 · Nota
• https://t.me/cveNotify/143310 · Publicação no Telegram
• https://t.me/CVEtracker/37724 · Publicação no Telegram
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3391762%40sureforms%2Ftrunk&old=3382423%40sureforms%2Ftrunk&sfp_email=&sfph_mail= · Nota
• https://wordfence.com/threat-intel/vulnerabilities/id/b083cf9d-bcfe-4234-a816-2d216da28b57?source=cve · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-12535 · Nota de Segurança