CVE-2025-10019

Executive Summary

CVE-2025-10019 is an Authorization Bypass Through User-Controlled Key vulnerability in the WordPress plugin "Contact Form Email" by Codepeople, affecting versions up to and including 1.3.60. This flaw allows an unauthenticated attacker to manipulate a user-controlled key (likely a form submission ID or nonce) to access or modify data that should be protected by access control checks. The vulnerability has a CVSS score of 6.5 (Medium), with a vector indicating network-based, low-complexity exploitation requiring no privileges or user interaction. The EPSS score is 0.0%, suggesting low current exploitation activity, but the lack of a confirmed patch makes this a significant supply chain risk for WordPress sites using this plugin.

Supply Chain & Package Security

This vulnerability affects the WordPress plugin ecosystem, specifically the "Contact Form Email" plugin. As a WordPress plugin, it is distributed via the official WordPress Plugin Directory and may be automatically updated if configured. The absence of a patch from the vendor (Codepeople) means that all sites running version 1.3.60 or earlier are exposed. Administrators must manually disable or remove the plugin until a fix is released. The plugin's functionality—handling form submissions—makes it a prime target for data exfiltration or privilege escalation.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No victim action required.
• Scope (S): Unchanged (U) – Exploit does not affect other components.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited data modification possible.
• Availability (A): None (N) – No denial of service.

Threat Level: Medium. The low EPSS score suggests limited active exploitation, but the ease of exploitation and lack of patch elevate the risk for WordPress sites.

Deep Dive & Mechanics

The vulnerability lies in the plugin's handling of user-controlled keys, likely used to reference form submissions or configuration data. In WordPress plugins, such keys are often passed via GET or POST parameters (e.g., submission_id, nonce, or form_key). The plugin fails to validate that the requesting user has permission to access the resource associated with that key. An attacker can enumerate or brute-force these keys to access other users' form submissions, modify form settings, or escalate privileges.

The core issue is a missing or insufficient authorization check. For example, a function like get_submission($key) might retrieve data based solely on the key without verifying the current user's role or ownership. This is a classic Insecure Direct Object Reference (IDOR) vulnerability, categorized under CWE-639.

Vulnerable vs. Patched Code

Since no patch is available, we can only hypothesize the vulnerable pattern. A typical vulnerable code snippet in a WordPress plugin might look like:

// Vulnerable code (<= 1.3.60)
function get_form_submission() {
    $submission_id = $_GET['submission_id'];
    global $wpdb;
    $result = $wpdb->get_row($wpdb->prepare("SELECT * FROM {$wpdb->prefix}cf7_submissions WHERE id = %d", $submission_id));
    // No capability check!
    return $result;
}

A patched version would include a capability check:

// Patched code (hypothetical)
function get_form_submission() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized');
    }
    $submission_id = $_GET['submission_id'];
    global $wpdb;
    $result = $wpdb->get_row($wpdb->prepare("SELECT * FROM {$wpdb->prefix}cf7_submissions WHERE id = %d", $submission_id));
    return $result;
}

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Install WordPress with the "Contact Form Email" plugin version 1.3.60.
2. Create a test form and submit it to generate a submission ID.
3. Use a tool like Burp Suite or curl to manipulate the key parameter.

Exploitation Steps:

1. Identify the vulnerable parameter (e.g., submission_id, form_key).
2. Enumerate valid keys by observing response differences (e.g., 200 vs 403).
3. Access other users' submissions or modify form data.

Example curl command to exploit:

curl -v "http://target/wp-admin/admin-ajax.php?action=get_submission&submission_id=2"

If the response returns data for submission ID 2 without authentication, the vulnerability is confirmed.

Blue Team (Defensive)

Detection:

• Monitor for unusual access patterns to admin-ajax.php or plugin-specific endpoints.
• Look for repeated requests with sequential or brute-forced submission IDs.
• Check for requests lacking a valid nonce or authentication cookie.

Mitigation:

• Immediately disable the plugin if no patch is available.
• Implement a Web Application Firewall (WAF) rule to block requests to vulnerable endpoints without proper authentication.
• Use a plugin like "Wordfence" to add virtual patching.

Indicators of Compromise (IOCs)

• Network: HTTP requests to /wp-admin/admin-ajax.php with parameters like action=get_submission or action=edit_form and a numeric submission_id.
• Logs: Repeated 200 responses to unauthenticated requests for submission data.
• File: Presence of the plugin directory /wp-content/plugins/contact-form-to-email/ version 1.3.60 or lower.
• Database: Unauthorized access to wp_cf7_submissions or similar tables.

Detection Engineering

YARA Rule

rule CVE_2025_10019_ContactFormEmail {
    meta:
        description = "Detects vulnerable Contact Form Email plugin files"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-10019"
    strings:
        $vuln_func = "get_submission" nocase
        $vuln_param = "$_GET['submission_id']" nocase
        $no_cap = "current_user_can" nocase
    condition:
        $vuln_func and $vuln_param and not $no_cap
}

Sigma Rule

title: CVE-2025-10019 - Authorization Bypass in Contact Form Email
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects exploitation attempts against CVE-2025-10019
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        c-uri|contains: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=get_submission'
    condition: selection
falsepositives:
    - Legitimate admin activity
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-10019 - Contact Form Email Authorization Bypass";
    flow:to_server,established;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=get_submission"; http_uri;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate Action: Disable or remove the "Contact Form Email" plugin until a patched version is released.
2. Virtual Patching: Use a WAF to block requests to admin-ajax.php with suspicious parameters without authentication.
3. Monitoring: Enable detailed logging for WordPress admin-ajax requests and review for anomalies.
4. Update: Subscribe to Codepeople's updates or the WordPress Plugin Directory for a fix.
5. Alternative: Migrate to a different contact form plugin with active security maintenance.

Valters IT
Securing Digital Frontiers