CVE-2025-11924

{"id": "CVE-2025-11924", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-11924", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-17T21:42:11.900723Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@wordfence.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@wordfence.com", "affectedData": [{"vendor": "kstover", "product": "Ninja Forms \u2013 The Contact Form Builder That Grows With You", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.13.2"}], "defaultStatus": "unaffected"}]}], "published": "2025-12-17T07:15:57.750", "references": [{"url": "https://plugins.trac.wordpress.org/changeset/3415563/ninja-forms", "tags": ["Patch"], "source": "security@wordfence.com"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4240cdae-9122-443e-8a7e-3369e74384be?source=cve", "tags": ["Third Party Advisory"], "source": "security@wordfence.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@wordfence.com", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "The Ninja Forms \u2013 The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.13.2. This is due to the plugin not properly verifying that a user is authorized before the `ninja-forms-views` REST endpoints return form metadata and submission content. This makes it possible for unauthenticated attackers to read arbitrary form definitions and submission records via a leaked bearer token granted they can load any page containing the Submissions Table block. NOTE: The developer released a patch for this issue in 3.13.1, but inadvertently introduced a REST API endpoint in which a valid bearer token could be minted for arbitrary form IDs, making this patch ineffective."}, {"lang": "es", "value": "El plugin Ninja Forms - The Contact Form Builder That Grows With You para WordPress es vulnerable a la Referencia Directa Insegura a Objetos en versiones hasta la 3.13.2, inclusive. Esto se debe a que el plugin no verifica correctamente que un usuario est\u00e1 autorizado antes de que los endpoints REST 'ninja-forms-views' devuelvan metadatos de formularios y contenido de env\u00edos. Esto hace posible que atacantes no autenticados lean definiciones de formularios y registros de env\u00edos arbitrarios a trav\u00e9s de un token de portador filtrado, siempre que puedan cargar cualquier p\u00e1gina que contenga el bloque Submissions Table. NOTA: El desarrollador lanz\u00f3 un parche para este problema en la versi\u00f3n 3.13.1, pero introdujo inadvertidamente un endpoint de API REST en el que se pod\u00eda generar un token de portador v\u00e1lido para IDs de formulario arbitrarios, lo que hizo que este parche fuera ineficaz."}], "lastModified": "2026-09-28T10:10:00.473", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ninjaforms:ninja_forms:*:*:*:*:*:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "16FE3FFA-18CE-46B5-8840-137710BBDD56", "versionEndExcluding": "3.13.1"}], "operator": "OR"}]}], "sourceIdentifier": "security@wordfence.com"}