CVE-2025-3912: WS Form LITE – Drag & Drop Contact Form Builder for WordPress <= 1.10.35 - Missing Authorization to Unauthenticated Sensitive Information Exposure
First published: Fri Apr 25 2025(Updated: )
The WS Form LITE – Drag & Drop Contact Form Builder for WordPress plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_config' function in all versions up to, and including, 1.10.35. This makes it possible for unauthenticated attackers to read the value of the plugin's settings, including API keys for integrated services.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| WS Form | <=1.10.35 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.wordfence.com/threat-intel/vulnerabilities/id/3f6058e2-a5ec-43b2-9cb7-9efcf0853ffc?source=cve
- https://plugins.trac.wordpress.org/browser/ws-form/trunk/ws-form.php
- https://plugins.trac.wordpress.org/browser/ws-form/trunk/api/class-ws-form-api.php
- https://plugins.trac.wordpress.org/browser/ws-form/trunk/includes/class-ws-form-config.php
- https://plugins.trac.wordpress.org/browser/ws-form/trunk/includes/class-ws-form-common.php
- https://plugins.trac.wordpress.org/changeset/3280355/
Frequently Asked Questions
What is the severity of CVE-2025-3912?
CVE-2025-3912 has a medium severity due to the potential for unauthorized access to sensitive data.
How do I fix CVE-2025-3912?
To fix CVE-2025-3912, update the WS Form LITE plugin to version 1.10.36 or later.
Which versions of the plugin are affected by CVE-2025-3912?
CVE-2025-3912 affects all versions up to and including 1.10.35 of the WS Form LITE plugin.
What is the impact of CVE-2025-3912?
The impact of CVE-2025-3912 allows unauthenticated users to access and retrieve configuration data.
Who is the vendor for CVE-2025-3912?
The vendor for CVE-2025-3912 is WS Form, which develops the WS Form LITE plugin for WordPress.
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/title
- agent/weakness
- agent/description
- agent/type
- agent/first-publish-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/author
- agent/severity
- agent/event
- collector/epss-latest
- source/FIRST
- agent/source
- agent/tags
- agent/epss
- vendor/ws form
- canonical/ws form