CVE-2025-32269: WordPress WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms Plugin <= 1.1.3 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability
First published: Fri Apr 04 2025(Updated: )
Cross-Site Request Forgery (CSRF) vulnerability in CRM Perks WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms allows Cross Site Request Forgery. This issue affects WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms: from n/a through 1.1.3.
Credit: audit@patchstack.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| CRM Perks WP Zendesk for Contact Form 7 | <=1.1.3 | |
| WPForms | <=1.1.3 | |
| CRM Perks Elementor | <=1.1.3 | |
| CRM Perks Formidable | <=1.1.3 | |
| CRM Perks Ninja Forms | <=1.1.3 |
Remedy
Update the WordPress WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms wordpress plugin to the latest available version (at least 1.1.4).
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2025-32269?
CVE-2025-32269 is classified as a moderate severity Cross-Site Request Forgery (CSRF) vulnerability.
How do I fix CVE-2025-32269?
To mitigate CVE-2025-32269, update the affected plugins, WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable, and Ninja Forms, to version 1.1.4 or later.
Which versions are affected by CVE-2025-32269?
CVE-2025-32269 affects versions 1.1.3 and lower of WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable, and Ninja Forms.
What types of attacks can CVE-2025-32269 enable?
CVE-2025-32269 can enable attackers to perform unauthorized actions on behalf of authenticated users due to Cross-Site Request Forgery.
Who is primarily impacted by CVE-2025-32269?
Users of the CRM Perks WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable, and Ninja Forms plugins are primarily impacted by CVE-2025-32269.
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/remedy
- agent/title
- agent/references
- agent/type
- agent/description
- agent/first-publish-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/author
- agent/last-modified-date
- agent/severity
- agent/event
- collector/epss-latest
- source/FIRST
- agent/source
- agent/tags
- agent/epss
- vendor/crm perks
- canonical/crm perks wp zendesk for contact form 7
- canonical/wpforms
- canonical/crm perks elementor
- canonical/crm perks formidable
- canonical/crm perks ninja forms