PT-2025-39706 · WordPress · Ninja Forms – The Contact Form Builder That Grows With You

Published 2025-09-27 · Updated 2025-09-27 · CVE-2025-10499

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress versions prior to 3.12.1

Description The software is susceptible to a Cross-Site Request Forgery (CSRF) issue. This is caused by inadequate or missing nonce validation within the maybe opt in() function. An unauthenticated attacker could potentially force an affected site to enable usage statistics collection by deceiving a site administrator into performing an action, such as clicking a link.

Recommendations Update Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress to version 3.12.1 or later.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-10499

Affected Products

Ninja Forms – The Contact Form Builder That Grows With You

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-10499 · Security Note
• https://osv.dev/vulnerability/CVE-2025-10499 · Vendor Advisory
• https://plugins.trac.wordpress.org/changeset/3365881/ninja-forms/trunk?contextall=1&old=3362375&old_path=%2Fninja-forms%2Ftrunk#file6 · Patch
• https://plugins.trac.wordpress.org/browser/ninja-forms/trunk/lib/NF_Tracking.php · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/a2f118fc-d99a-4713-865e-2da7a9e20db5?source=cve · Note
• https://t.me/CVEtracker/33519 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1971832133879546035 · Twitter Post
• https://twitter.com/CVEnew/status/1971773990378275299 · Twitter Post
• https://t.me/cveNotify/136679 · Telegram Post