CVE-2025-10499: Ninja Forms – The Contact Form Builder That Grows With You <= 3.12.0 - Cross-Site Request Forgery to Plugin Settings Update
The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.12.0. This is due to missing or incorrect nonce validation on the maybeoptin() function. This makes it possible for unauthenticated attackers to opt an affected site into usage statistics collection via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-10499?
CVE-2025-10499 is classified as a high severity vulnerability due to its potential for Cross-Site Request Forgery.
How do I fix CVE-2025-10499?
To fix CVE-2025-10499, update the Ninja Forms plugin to version 3.12.1 or later.
What versions are affected by CVE-2025-10499?
CVE-2025-10499 affects all versions of Ninja Forms up to and including 3.12.0.
What is Cross-Site Request Forgery in relation to CVE-2025-10499?
In the context of CVE-2025-10499, Cross-Site Request Forgery allows attackers to trick users into executing unwanted actions on the website.
What function is associated with CVE-2025-10499?
CVE-2025-10499 is associated with the maybe_opt_in() function, which lacks proper nonce validation.