CVE-2025-0939

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-0939", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-01-31T17:56:49.931Z", "datePublished": "2025-02-01T06:41:51.508Z", "dateUpdated": "2026-04-08T17:14:19.736Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:14:19.736Z"}, "affected": [{"vendor": "dcooperman", "product": "MagicForm", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.6.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The MagicForm plugin for WordPress is vulnerable to access and modification of data due to a missing capability check on the plugin's AJAX actions in all versions up to, and including, 1.6.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to invoke those actions in order to delete or view logs, modify forms or modify plugin settings."}], "title": "MagicForm - WordPress Form Builder <= 1.6.2 - Missing Authorization", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/aa3497ae-7f3a-4e67-ad7a-77b50dccaf3b?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/magicform/trunk/admin/admin-menu.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "baseScore": 6.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Lucio S\u00e1"}], "timeline": [{"time": "2025-01-31T18:12:29.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-02-03T16:07:50.510559Z", "id": "CVE-2025-0939", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-03T16:37:39.052Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-0939", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-02-03T16:07:50.510559Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-03T16:07:52.042Z"}}], "cna": {"title": "MagicForm - WordPress Form Builder <= 1.6.2 - Missing Authorization", "credits": [{"lang": "en", "type": "finder", "value": "Lucio S\u00e1"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"}}], "affected": [{"vendor": "dcooperman", "product": "MagicForm", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.6.2"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-01-31T18:12:29.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/aa3497ae-7f3a-4e67-ad7a-77b50dccaf3b?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/magicform/trunk/admin/admin-menu.php"}], "descriptions": [{"lang": "en", "value": "The MagicForm plugin for WordPress is vulnerable to access and modification of data due to a missing capability check on the plugin's AJAX actions in all versions up to, and including, 1.6.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to invoke those actions in order to delete or view logs, modify forms or modify plugin settings."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:14:19.736Z"}}}, "cveMetadata": {"cveId": "CVE-2025-0939", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:14:19.736Z", "dateReserved": "2025-01-31T17:56:49.931Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-02-01T06:41:51.508Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "MagicForm", "vendor": "dcooperman", "versions": [{"lessThanOrEqual": "1.6.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:dcooperman:magicform:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "46516755-F308-4A2E-BCF1-4F0CC9FCBCF3", "versionEndIncluding": "1.6.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The MagicForm plugin for WordPress is vulnerable to access and modification of data due to a missing capability check on the plugin's AJAX actions in all versions up to, and including, 1.6.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to invoke those actions in order to delete or view logs, modify forms or modify plugin settings."}, {"lang": "es", "value": "El complemento MagicForm para WordPress es vulnerable al acceso y la modificaci\u00f3n de datos debido a una falta de comprobaci\u00f3n de capacidad en las acciones AJAX del complemento en todas las versiones hasta la 1.6.2 y incluida. Esto hace posible que atacantes autenticados, con acceso de nivel de suscriptor y superior, invoquen esas acciones para eliminar o ver registros, modificar formularios o modificar la configuraci\u00f3n del complemento."}], "id": "CVE-2025-0939", "lastModified": "2026-06-17T08:27:24.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-0939", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-02-03T16:07:50.510559Z", "version": "2.0.3"}}]}, "published": "2025-02-01T07:15:08.097", "references": [{"source": "security@wordfence.com", "tags": ["Patch"], "url": "https://plugins.trac.wordpress.org/browser/magicform/trunk/admin/admin-menu.php"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/aa3497ae-7f3a-4e67-ad7a-77b50dccaf3b?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T22:25:50.238377+00:00", "value": {"mitigation_remediation": ["Update the MagicForm plugin to a version newer than 1.6.2 to restore proper capability checks on all AJAX actions.", "Limit administrative access so that only users with Editor or higher roles can use the plugin\u2019s features, and remove or downgrade the Subscriber role if it is unnecessary.", "Add an additional security layer by configuring a plugin or custom code that ensures wp_verify_nonce and current_user_can checks are performed before any AJAX handler processes requests."], "summary": {"action": "Apply patch", "impact": "Unauthorized Data Manipulation"}, "threat_synthesis": {"affected_systems": "The flaw affects all releases of the MagicForm WordPress plugin up to and including version 1.6.2, which is distributed by the developer dcooperman. Any WordPress site running one of these versions is susceptible.", "description_and_impact": "The vulnerability resides in a missing capability check on the MagicForm plugin\u2019s AJAX actions. An authenticated user with Subscriber level or higher can therefore invoke these endpoints to delete or view logs, modify form definitions, or change plugin settings, effectively allowing them to alter data they should not be able to access.", "risk_and_exploitability": "With a CVSS score of 6.3 the issue is considered moderate in severity. The EPSS score is below 1%, indicating that exploitation is unlikely in the wild, and it has not been noted in CISA\u2019s KEV catalog. The attack requires an authenticated account with at least Subscriber privileges; the perpetrator can trigger the vulnerable AJAX endpoint via an HTTP request, making the flaw straightforward to abuse once credentials are in hand."}}}}, "created": "2026-04-21T22:30:06.134119+00:00", "updated": "2026-04-21T22:30:06.134135+00:00", "vendors": []}