CVE-2025-11924

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-11924", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-17T18:54:25.934Z", "datePublished": "2025-12-17T06:42:30.758Z", "dateUpdated": "2026-04-08T16:48:52.125Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:48:52.125Z"}, "affected": [{"vendor": "kstover", "product": "Ninja Forms \u2013 The Contact Form Builder That Grows With You", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.13.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Ninja Forms \u2013 The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.13.2. This is due to the plugin not properly verifying that a user is authorized before the `ninja-forms-views` REST endpoints return form metadata and submission content. This makes it possible for unauthenticated attackers to read arbitrary form definitions and submission records via a leaked bearer token granted they can load any page containing the Submissions Table block. NOTE: The developer released a patch for this issue in 3.13.1, but inadvertently introduced a REST API endpoint in which a valid bearer token could be minted for arbitrary form IDs, making this patch ineffective."}], "title": "Ninja Forms \u2013 The Contact Form Builder That Grows With You <= 3.13.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Unscoped Bearer Token", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4240cdae-9122-443e-8a7e-3369e74384be?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3415563/ninja-forms"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-639 Authorization Bypass Through User-Controlled Key", "cweId": "CWE-639", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Lucas Montes"}, {"lang": "en", "type": "finder", "value": "Marcin Dudek"}], "timeline": [{"time": "2025-10-20T21:23:51.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-12-16T18:41:16.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-17T21:42:11.900723Z", "id": "CVE-2025-11924", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-17T21:42:22.536Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-11924", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-17T21:42:11.900723Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-17T21:42:17.956Z"}}], "cna": {"title": "Ninja Forms \u2013 The Contact Form Builder That Grows With You <= 3.13.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Unscoped Bearer Token", "credits": [{"lang": "en", "type": "finder", "value": "Lucas Montes"}, {"lang": "en", "type": "finder", "value": "Marcin Dudek"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}}], "affected": [{"vendor": "kstover", "product": "Ninja Forms \u2013 The Contact Form Builder That Grows With You", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "3.13.2"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-20T21:23:51.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-12-16T18:41:16.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4240cdae-9122-443e-8a7e-3369e74384be?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3415563/ninja-forms"}], "descriptions": [{"lang": "en", "value": "The Ninja Forms \u2013 The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.13.2. This is due to the plugin not properly verifying that a user is authorized before the `ninja-forms-views` REST endpoints return form metadata and submission content. This makes it possible for unauthenticated attackers to read arbitrary form definitions and submission records via a leaked bearer token granted they can load any page containing the Submissions Table block. NOTE: The developer released a patch for this issue in 3.13.1, but inadvertently introduced a REST API endpoint in which a valid bearer token could be minted for arbitrary form IDs, making this patch ineffective."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639 Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-12-17T06:42:30.758Z"}}}, "cveMetadata": {"cveId": "CVE-2025-11924", "state": "PUBLISHED", "dateUpdated": "2025-12-17T21:42:22.536Z", "dateReserved": "2025-10-17T18:54:25.934Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-12-17T06:42:30.758Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Ninja Forms \u2013 The Contact Form Builder That Grows With You", "vendor": "kstover", "versions": [{"lessThanOrEqual": "3.13.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ninjaforms:ninja_forms:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "16FE3FFA-18CE-46B5-8840-137710BBDD56", "versionEndExcluding": "3.13.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Ninja Forms \u2013 The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.13.2. This is due to the plugin not properly verifying that a user is authorized before the `ninja-forms-views` REST endpoints return form metadata and submission content. This makes it possible for unauthenticated attackers to read arbitrary form definitions and submission records via a leaked bearer token granted they can load any page containing the Submissions Table block. NOTE: The developer released a patch for this issue in 3.13.1, but inadvertently introduced a REST API endpoint in which a valid bearer token could be minted for arbitrary form IDs, making this patch ineffective."}, {"lang": "es", "value": "El plugin Ninja Forms - The Contact Form Builder That Grows With You para WordPress es vulnerable a la Referencia Directa Insegura a Objetos en versiones hasta la 3.13.2, inclusive. Esto se debe a que el plugin no verifica correctamente que un usuario est\u00e1 autorizado antes de que los endpoints REST 'ninja-forms-views' devuelvan metadatos de formularios y contenido de env\u00edos. Esto hace posible que atacantes no autenticados lean definiciones de formularios y registros de env\u00edos arbitrarios a trav\u00e9s de un token de portador filtrado, siempre que puedan cargar cualquier p\u00e1gina que contenga el bloque Submissions Table. NOTA: El desarrollador lanz\u00f3 un parche para este problema en la versi\u00f3n 3.13.1, pero introdujo inadvertidamente un endpoint de API REST en el que se pod\u00eda generar un token de portador v\u00e1lido para IDs de formulario arbitrarios, lo que hizo que este parche fuera ineficaz."}], "id": "CVE-2025-11924", "lastModified": "2026-09-28T10:10:00.473", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-11924", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-12-17T21:42:11.900723Z", "version": "2.0.3"}}]}, "published": "2025-12-17T07:15:57.750", "references": [{"source": "security@wordfence.com", "tags": ["Patch"], "url": "https://plugins.trac.wordpress.org/changeset/3415563/ninja-forms"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4240cdae-9122-443e-8a7e-3369e74384be?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T12:13:33.740505+00:00", "value": {"mitigation_remediation": ["Upgrade the Ninja Forms plugin to the latest stable release that removes the IDOR flaw (currently 3.13.3 or newer).", "Block unauthenticated access to the `ninja\u2011forms\u2011views` REST endpoints using a web\u2011application firewall, security plugin, or server\u2011side rules such as .htaccess restrictions.", "Review all existing form submissions for exposed sensitive data, delete or redact any compromised entries, and rotate any credentials that may have been inadvertently included in submissions."], "summary": {"action": "Patch Now", "impact": "Unauthenticated Sensitive Information Exposure"}, "threat_synthesis": {"affected_systems": "The affected product is the Ninja Forms\u00a0\u2013\u00a0The Contact Form Builder That Grows With You plugin for WordPress. All releases through version 3.13.2 are vulnerable. Although an earlier patch was released in 3.13.1, it introduced a new flaw that still allows bearer\u2011token generation for arbitrary forms, so only versions later than 3.13.2 (currently 3.13.3 and newer) are considered safe.", "description_and_impact": "The vulnerability is an Insecure Direct Object Reference that allows an unauthenticated attacker to retrieve complete form metadata and any submitted data by using a bearer token that was leaked when a page containing the Submissions Table block was loaded. Because the plugin fails to validate that a user is authorized to access this data, an attacker can obtain arbitrary form definitions and submission records, potentially exposing sensitive personal information and credentials. The weakness is cataloged as CWE\u2011639 and can lead to significant confidentiality breaches if sensitive submission content is captured.", "risk_and_exploitability": "The CVSS score of 7.5 indicates high severity, while the EPSS score of less than 1% suggests a very low probability of active exploitation at present. The vulnerability is not listed in the CISA KEV catalog, which supports the low likelihood assessment. However, if an attacker can obtain a bearer token, the IDOR can be exploited via the publicly exposed REST endpoints, giving them read\u2011only access to all submission data. The impact is therefore primarily confidentiality exposure and possible compromise of personal data."}}}}, "created": "2025-12-17T14:28:29.628651+00:00", "updated": "2026-04-22T12:15:16.039766+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}