Plataforma
wordpress
Componente
sureforms
Corregido en
1.13.2
CVE-2025-12535 describes a Cross-Site Request Forgery (CSRF) Bypass vulnerability affecting the SureForms plugin for WordPress. This flaw allows unauthenticated attackers to bypass CSRF protection on REST API endpoints, potentially leading to unauthorized actions. The vulnerability impacts versions 0.0.0 through 1.13.1, and a patch is available in version 1.13.2.
The CSRF Bypass vulnerability in SureForms allows an attacker to craft malicious requests that appear to originate from a legitimate user. Because the plugin incorrectly uses generic WordPress REST API nonces instead of form-specific nonces for unauthenticated submissions, attackers can exploit this to perform actions as the user without needing authentication. This could include modifying form data, creating new forms with malicious configurations, or potentially gaining access to sensitive information stored within the plugin. The blast radius extends to any user who interacts with forms built using the vulnerable plugin, especially if those forms handle sensitive data or perform critical actions.
CVE-2025-12535 was publicly disclosed on 2025-11-19. While no public proof-of-concept (PoC) has been released as of this writing, the vulnerability's nature and ease of exploitation suggest a moderate probability of exploitation. The vulnerability is not currently listed on CISA KEV. Attackers targeting WordPress sites are likely to prioritize this vulnerability due to its relatively simple exploitation path.
Websites utilizing the SureForms plugin for contact forms, payment forms, or custom form building are at risk. Shared hosting environments where multiple WordPress sites share the same server resources are particularly vulnerable, as a compromise on one site could potentially impact others. Users relying on SureForms for critical data collection or processing should prioritize patching.
• wordpress / composer / npm:
grep -r 'wp_ajax_nopriv_rest-nonce' /var/www/html/wp-content/plugins/sureforms/• wordpress / composer / npm:
wp plugin list --status=all | grep sureforms• wordpress / composer / npm:
wp plugin update sureforms• generic web: Check WordPress REST API endpoints for unexpected behavior or unauthorized modifications using curl or wget.
disclosure
Estado del Exploit
EPSS
0.12% (31% percentil)
CISA SSVC
Vector CVSS
The primary mitigation for CVE-2025-12535 is to immediately upgrade the SureForms plugin to version 1.13.2 or later. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to filter requests containing the 'wpajaxnopriv_rest-nonce' action with generic nonces. Additionally, review and restrict access to WordPress REST API endpoints to minimize the potential impact of a successful attack. Monitor WordPress logs for suspicious activity related to REST API calls and form submissions.
Actualizar a la versión 1.13.2, o una versión parcheada más reciente
Análisis de vulnerabilidades y alertas críticas directamente en tu correo.
CVE-2025-12535 is a Cross-Site Request Forgery (CSRF) Bypass vulnerability in the SureForms WordPress plugin, allowing attackers to bypass CSRF protection on REST API endpoints.
If you are using SureForms plugin versions 0.0.0 through 1.13.1, you are affected by this vulnerability.
Upgrade the SureForms plugin to version 1.13.2 or later to remediate the vulnerability. Consider WAF rules as a temporary workaround.
While no public exploit is currently known, the vulnerability's ease of exploitation suggests a moderate probability of exploitation.
Refer to the official SureForms plugin documentation and WordPress security announcements for the latest advisory and updates.
Sube tu archivo de dependencias y detecta esta y otras CVEs al instante.
Sube tu archivo de dependencias y detecta esta y otras CVEs al instante.