CVE-2025-64369

Executive Summary

CVE-2025-64369 is a Missing Authorization vulnerability in the WordPress plugin Contact Form Email by Codepeople. This flaw allows an unauthenticated attacker to exploit incorrectly configured access control security levels, potentially leading to unauthorized data access or modification. The vulnerability affects all versions up to and including 1.3.58. As of this report, no official patch has been released, and no public proof-of-concept (PoC) or exploit code is available. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk remains significant due to the widespread use of WordPress and the plugin's functionality.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress plugin repository and third-party marketplaces. Users are advised to monitor the plugin's page for updates and consider temporary disabling or replacing the plugin if no patch is forthcoming.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
• Base Score: 6.5 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The vulnerability is exploitable remotely without authentication, making it a moderate threat. The impact is limited to low confidentiality and integrity loss, but combined with other vulnerabilities, it could be chained for more severe attacks.

Deep Dive & Mechanics

The vulnerability resides in the Contact Form Email plugin's REST API or AJAX handlers, where authorization checks are missing or improperly implemented. The plugin likely exposes endpoints for managing contact form submissions, settings, or logs without verifying the user's capabilities. An attacker can send crafted HTTP requests to these endpoints to:

• Retrieve sensitive form data (e.g., email addresses, messages).
• Modify plugin settings (e.g., redirect emails to attacker-controlled addresses).
• Delete or export submission logs.

The root cause is the failure to call current_user_can() or similar WordPress capability checks before executing privileged actions. This is a classic CWE-862: Missing Authorization issue.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code pattern is hypothesized based on common WordPress plugin flaws:

Vulnerable Code (hypothetical):

add_action('wp_ajax_nopriv_export_submissions', 'export_submissions');
function export_submissions() {
    // No capability check
    $submissions = get_all_submissions();
    echo json_encode($submissions);
    wp_die();
}

Patched Code (expected):

add_action('wp_ajax_export_submissions', 'export_submissions');
add_action('wp_ajax_nopriv_export_submissions', 'export_submissions');
function export_submissions() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    $submissions = get_all_submissions();
    echo json_encode($submissions);
    wp_die();
}

The patch would add a capability check (e.g., manage_options) and potentially restrict the action to authenticated users only.

Exploitation & Lab Setup

Red Team (Exploitation)

1. Reconnaissance: Identify WordPress sites running the vulnerable plugin version. Use Shodan dorks or WPScan.
2. Endpoint Discovery: Enumerate AJAX actions or REST routes. Common patterns include:
   • /wp-admin/admin-ajax.php?action=export_submissions
   • /wp-json/contact-form-email/v1/submissions
3. Exploit: Send a crafted request without authentication:

   curl -X POST "http://target.com/wp-admin/admin-ajax.php" \
        -d "action=export_submissions&format=csv"
   

   If successful, the response contains sensitive data.

Blue Team (Defense & Detection)

1. Monitor Logs: Look for repeated requests to admin-ajax.php with unknown or suspicious action parameters.
2. Web Application Firewall (WAF): Block requests to admin-ajax.php that do not include a valid nonce or authentication cookie.
3. Plugin Hardening: Disable the plugin or apply a virtual patch via WAF rules until an official fix is released.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /wp-admin/admin-ajax.php with action parameters like export_submissions, get_settings, or delete_logs.
  • Unusual outbound traffic from the WordPress server to attacker-controlled IPs (e.g., exfiltration of form data).
• File IOCs:
  • Modified plugin files (e.g., contact-form-to-email.php) with unauthorized changes.
  • New files in /wp-content/uploads/ containing exported data.
• Log IOCs:
  • WordPress debug log entries showing wp_die or 403 errors for AJAX requests.
  • Web server access logs with POST /wp-admin/admin-ajax.php from unknown IPs.

Detection Engineering

YARA Rule

rule CVE_2025_64369_ContactFormEmail_MissingAuth {
    meta:
        description = "Detects exploitation attempts of CVE-2025-64369 in Contact Form Email plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-64369"
    strings:
        $ajax_action = "action=export_submissions" nocase
        $ajax_action2 = "action=get_settings" nocase
        $plugin_path = "contact-form-to-email" nocase
    condition:
        any of ($ajax_action*) and $plugin_path
}

Sigma Rule

title: CVE-2025-64369 - Missing Authorization in Contact Form Email Plugin
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthorized access attempts to Contact Form Email plugin endpoints
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        c-uri|contains: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 
            - 'action=export_submissions'
            - 'action=get_settings'
            - 'action=delete_logs'
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: high

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2025-64369 - Contact Form Email Missing Authorization Exploit";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=export_submissions"; http_client_body;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
    reference:cve,2025-64369;
)

Remediation & Mitigation

1. Immediate Action: Disable the Contact Form Email plugin until a patch is released.
2. Virtual Patching: Use a WAF to block requests to admin-ajax.php with suspicious action parameters.
3. Monitor: Review access logs for exploitation attempts and check for unauthorized data access.
4. Update: Subscribe to the plugin's changelog or GitHub repository for patch announcements.
5. Alternative: Replace the plugin with a more secure alternative (e.g., Contact Form 7 with Flamingo).

Valters IT
Securing Digital Frontiers