CVE-2025-58639
BaseFortify
Publication date: 2025-09-03
Last updated on: 2026-04-23
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mega_forms | contact_form_by_mega_forms | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Missing Authorization (Broken Access Control) issue in the WordPress Contact Form By Mega Forms plugin up to version 1.6.1. It occurs because certain plugin functions lack proper authorization, authentication, or nonce token checks, allowing users with low privileges (Subscriber-level) to perform actions that should be restricted to higher-privileged users. This type of vulnerability is classified under OWASP Top 10 category A1: Broken Access Control. [1]
How can this vulnerability impact me? :
The impact of this vulnerability is that unprivileged users can perform unauthorized actions within the plugin, potentially leading to limited integrity and availability issues. Although the severity is rated as low (CVSS 5.4), it could allow attackers to manipulate plugin functions improperly, which might disrupt normal operations or cause minor damage. It is unlikely to be widely exploited but should be addressed promptly to avoid opportunistic automated attacks. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of this vulnerability involves checking the version of the Contact Form By Mega Forms plugin installed on your WordPress site. Since the vulnerability is due to missing authorization checks allowing Subscriber-level users to perform higher-privileged actions, monitoring for unusual privilege escalations or unauthorized actions by low-privileged users can help detect exploitation attempts. There are no specific commands provided for detection. Patchstack recommends professional incident response or hosting provider assistance rather than relying solely on plugin-based malware scanners, as these can be tampered with by malware. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate step to mitigate this vulnerability is to update the Contact Form By Mega Forms plugin to version 1.6.2 or later, where the issue is resolved. Alternatively, Patchstack offers virtual patching (vPatching) which provides automatic mitigation of the vulnerability before official patches are applied. Prompt updating is emphasized to prevent opportunistic automated attacks. In case of compromise, professional incident response or assistance from your hosting provider is recommended. [1]