PT-2025-39705 · WordPress · Ninja Forms

Published 2025-09-27 · Updated 2025-09-27 · CVE-2025-10498

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Ninja Forms – The Contact Form Builder That Grows With You versions prior to 3.12.1

Description The software is susceptible to Cross-Site Request Forgery (CSRF) due to inadequate nonce validation when exporting CSV files. This allows unauthenticated attackers to delete CSV files if they can trick an administrator into performing an action, such as clicking a malicious link.

Recommendations Update Ninja Forms – The Contact Form Builder That Grows With You to version 3.12.1 or later.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-10498

Affected Products

Ninja Forms

References · 9

• https://plugins.trac.wordpress.org/changeset/3365881/ninja-forms/trunk?contextall=1&old=3362375&old_path=%2Fninja-forms%2Ftrunk#file6 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-10498 · Security Note
• https://osv.dev/vulnerability/CVE-2025-10498 · Vendor Advisory
• https://plugins.trac.wordpress.org/browser/ninja-forms/trunk/includes/Admin/Menus/Submissions.php#L464 · Note
• https://t.me/CVEtracker/33520 · Telegram Post
• https://t.me/cveNotify/136678 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1971834693797437509 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/b082176c-9486-416c-8215-cdba4d6e5260?source=cve · Note
• https://twitter.com/CVEnew/status/1971773989308780562 · Twitter Post