CVE-2025-0939
6.3
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Exploitability: 2.8 / Impact: 3.4
Source: security@wordfence.com (Secondary)
Description
The MagicForm plugin for WordPress is vulnerable to access and modification of data due to a missing capability check on the plugin's AJAX actions in all versions up to, and including, 1.6.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to invoke those actions in order to delete or view logs, modify forms or modify plugin settings.
Affected (1)
Products: Dcooperman: Magicform
Configuration A
| Vulnerable Software | Affected Versions |
|---|---|
| Up to 1.6.2 |
References (2)
Source: security@wordfence.com
Patch
Source: security@wordfence.com
Third Party Advisory
Timeline
No history available yet.