平台
wordpress
组件
sureforms
修复版本
1.13.2
CVE-2025-12535 describes a Cross-Site Request Forgery (CSRF) Bypass vulnerability affecting the SureForms plugin for WordPress. This flaw allows unauthenticated attackers to bypass CSRF protection on REST API endpoints, potentially leading to unauthorized actions. The vulnerability impacts versions 0.0.0 through 1.13.1, and a patch is available in version 1.13.2.
The CSRF Bypass vulnerability in SureForms allows an attacker to craft malicious requests that appear to originate from a legitimate user. Because the plugin incorrectly uses generic WordPress REST API nonces instead of form-specific nonces for unauthenticated submissions, attackers can exploit this to perform actions as the user without needing authentication. This could include modifying form data, creating new forms with malicious configurations, or potentially gaining access to sensitive information stored within the plugin. The blast radius extends to any user who interacts with forms built using the vulnerable plugin, especially if those forms handle sensitive data or perform critical actions.
CVE-2025-12535 was publicly disclosed on 2025-11-19. While no public proof-of-concept (PoC) has been released as of this writing, the vulnerability's nature and ease of exploitation suggest a moderate probability of exploitation. The vulnerability is not currently listed on CISA KEV. Attackers targeting WordPress sites are likely to prioritize this vulnerability due to its relatively simple exploitation path.
Websites utilizing the SureForms plugin for contact forms, payment forms, or custom form building are at risk. Shared hosting environments where multiple WordPress sites share the same server resources are particularly vulnerable, as a compromise on one site could potentially impact others. Users relying on SureForms for critical data collection or processing should prioritize patching.
• wordpress / composer / npm:
grep -r 'wp_ajax_nopriv_rest-nonce' /var/www/html/wp-content/plugins/sureforms/• wordpress / composer / npm:
wp plugin list --status=all | grep sureforms• wordpress / composer / npm:
wp plugin update sureforms• generic web: Check WordPress REST API endpoints for unexpected behavior or unauthorized modifications using curl or wget.
disclosure
漏洞利用状态
EPSS
0.12% (31% 百分位)
CISA SSVC
CVSS 向量
The primary mitigation for CVE-2025-12535 is to immediately upgrade the SureForms plugin to version 1.13.2 or later. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to filter requests containing the 'wpajaxnopriv_rest-nonce' action with generic nonces. Additionally, review and restrict access to WordPress REST API endpoints to minimize the potential impact of a successful attack. Monitor WordPress logs for suspicious activity related to REST API calls and form submissions.
更新到 1.13.2 版本，或更新的补丁版本
漏洞分析和关键警报直接发送到您的邮箱。
CVE-2025-12535 is a Cross-Site Request Forgery (CSRF) Bypass vulnerability in the SureForms WordPress plugin, allowing attackers to bypass CSRF protection on REST API endpoints.
If you are using SureForms plugin versions 0.0.0 through 1.13.1, you are affected by this vulnerability.
Upgrade the SureForms plugin to version 1.13.2 or later to remediate the vulnerability. Consider WAF rules as a temporary workaround.
While no public exploit is currently known, the vulnerability's ease of exploitation suggests a moderate probability of exploitation.
Refer to the official SureForms plugin documentation and WordPress security announcements for the latest advisory and updates.
上传你的依赖文件，立即了解此CVE和其他CVE是否影响你。