What is the severity of CVE-2025-0939?

CVE-2025-0939 has a high severity rating as it allows authenticated attackers to access and modify data.

How do I fix CVE-2025-0939?

To fix CVE-2025-0939, you should update the MagicForm plugin to version 1.6.3 or later, which includes the necessary capability checks.

Who is affected by CVE-2025-0939?

CVE-2025-0939 affects all versions of the MagicForm plugin up to and including 1.6.2, impacting WordPress users with Subscriber-level access and above.

What actions are vulnerable in CVE-2025-0939?

CVE-2025-0939 involves multiple AJAX actions within the MagicForm plugin that lack proper capability checks.

Is it necessary to patch CVE-2025-0939 immediately?

Yes, it is crucial to patch CVE-2025-0939 immediately to prevent unauthorized data access and modification by authenticated attackers.

Vulnerability/
CVE-2025-0939

medium

6.3

CWE

862

1/2/2025

21/2/2025

CVE-2025-0939

First published: Sat Feb 01 2025(Updated: )

The MagicForm plugin for WordPress is vulnerable to access and modification of data due to a missing capability check on the plugin's AJAX actions in all versions up to, and including, 1.6.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to invoke those actions in order to delete or view logs, modify forms or modify plugin settings.

Credit: security@wordfence.com

Affected Software	Affected Version	How to fix
MagicForm	<=1.6.2
WordPress	<=1.6.2
Dcooperman Magicform Wordpress	<=1.6.2

Remedy

https://plugins.trac.wordpress.org/browser/magicform/trunk/admin/admin-menu.php

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is the severity of CVE-2025-0939?
CVE-2025-0939 has a high severity rating as it allows authenticated attackers to access and modify data.
How do I fix CVE-2025-0939?
To fix CVE-2025-0939, you should update the MagicForm plugin to version 1.6.3 or later, which includes the necessary capability checks.
Who is affected by CVE-2025-0939?
CVE-2025-0939 affects all versions of the MagicForm plugin up to and including 1.6.2, impacting WordPress users with Subscriber-level access and above.
What actions are vulnerable in CVE-2025-0939?
CVE-2025-0939 involves multiple AJAX actions within the MagicForm plugin that lack proper capability checks.
Is it necessary to patch CVE-2025-0939 immediately?
Yes, it is crucial to patch CVE-2025-0939 immediately to prevent unauthorized data access and modification by authenticated attackers.

agent/type
agent/first-publish-date
agent/references
agent/description
agent/severity
agent/author
agent/source
agent/weakness
agent/guess-ai
agent/software-canonical-lookup
agent/event
agent/last-modified-date
agent/remedy
agent/softwarecombine
collector/nvd-api
source/NVD
agent/software-canonical-lookup-request
agent/tags
vendor/magicform
canonical/magicform
vendor/wordpress
canonical/wordpress
vendor/dcooperman
canonical/dcooperman magicform wordpress
version/dcooperman magicform wordpress/1.6.2

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.