CVE-2025-12825
BaseFortify
Publication date: 2026-01-17
Last updated on: 2026-01-17
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| unknown_vendor | user_registration_using_contact_form_7 | to 2.5 (inc) |
| unknown_vendor | user_registration_using_contact_form_7 | 2.6 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability in the User Registration Using Contact Form 7 WordPress plugin allowed unauthenticated attackers to access sensitive form data because the function 'get_cf7_form_data' lacked proper capability checks and nonce verification. This meant attackers could retrieve form settings, including Facebook app secrets, without authorization. The issue was fixed in version 2.6 by adding nonce verification and user capability checks to ensure only authorized users can access this data. [2]
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized disclosure of sensitive information such as Facebook app secrets from the plugin's form settings. An attacker exploiting this could potentially misuse these secrets, leading to security breaches or unauthorized actions related to the Facebook app integration. Since the vulnerability allows data access without authentication, it poses a risk to the confidentiality of sensitive data. [2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect this vulnerability by checking if your WordPress installation is running the User Registration Using Contact Form 7 plugin version 2.5 or earlier, which lacks nonce and capability checks on AJAX requests for form data. To test for exploitation attempts, you might monitor HTTP POST requests to the AJAX handler that include the 'get_cf7_form_data' action without a valid nonce or from unauthenticated users. For example, using curl to simulate a request without a nonce: curl -X POST -d 'action=get_cf7_form_data' https://yourwordpresssite.com/wp-admin/admin-ajax.php and observing if sensitive form data is returned. Additionally, reviewing web server logs for such unauthorized AJAX requests can help detect exploitation attempts. [2]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to update the User Registration Using Contact Form 7 plugin to version 2.6 or later, where nonce verification and user capability checks have been implemented to prevent unauthorized access. If updating immediately is not possible, restrict access to the WordPress admin AJAX endpoint and monitor for suspicious requests. Also, consider disabling the plugin temporarily until the update can be applied. [2]