CVE-2025-0939: MagicForm - WordPress Form Builder <= 1.6.2 - Missing Authorization
The MagicForm plugin for WordPress is vulnerable to access and modification of data due to a missing capability check on the plugin's AJAX actions in all versions up to, and including, 1.6.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to invoke those actions in order to delete or view logs, modify forms or modify plugin settings.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-0939?
CVE-2025-0939 has a high severity rating as it allows authenticated attackers to access and modify data.
How do I fix CVE-2025-0939?
To fix CVE-2025-0939, you should update the MagicForm plugin to version 1.6.3 or later, which includes the necessary capability checks.
Who is affected by CVE-2025-0939?
CVE-2025-0939 affects all versions of the MagicForm plugin up to and including 1.6.2, impacting WordPress users with Subscriber-level access and above.
What actions are vulnerable in CVE-2025-0939?
CVE-2025-0939 involves multiple AJAX actions within the MagicForm plugin that lack proper capability checks.
Is it necessary to patch CVE-2025-0939 immediately?
Yes, it is crucial to patch CVE-2025-0939 immediately to prevent unauthorized data access and modification by authenticated attackers.