CVE-2025-12535: SureForms WordPress CSRF Bypass Vulnerability

CVE-2025-12535 Overview

CVE-2025-12535 affects the SureForms plugin for WordPress in all versions up to and including 1.13.1. The plugin distributes generic WordPress REST API nonces (wp_rest) to unauthenticated users through the wp_ajax_nopriv_rest-nonce action. While SureForms legitimately supports unauthenticated form submissions, it uses generic REST nonces instead of form-specific nonces. This design allows unauthenticated attackers to bypass Cross-Site Request Forgery (CSRF) protection on REST API endpoints that rely solely on nonce verification. The flaw is categorized under CWE-352.

Critical Impact
Unauthenticated attackers can obtain valid wp_rest nonces and trigger unauthorized actions across the plugin's post-submission hooks and other plugins' REST endpoints that trust nonce verification.

Affected Products

SureForms plugin for WordPress — all versions through 1.13.1
WordPress sites using SureForms with nonce-only protected REST endpoints
Third-party plugins whose REST endpoints depend solely on wp_rest nonce verification

Discovery Timeline

2025-11-19 - CVE-2025-12535 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12535

Vulnerability Analysis

The vulnerability is a CSRF bypass rooted in improper nonce scope. WordPress nonces created with wp_create_nonce('wp_rest') are the generic nonces that authorize any request to the WordPress REST API for the current session. SureForms exposes an AJAX endpoint registered under wp_ajax_nopriv_rest-nonce that returns a fresh wp_rest nonce to any unauthenticated visitor. Any attacker can request this endpoint, receive a valid nonce, and then submit REST API calls that appear to originate from a legitimate browser session.

Root Cause

The root cause is a design mistake in inc/admin-ajax.php and inc/background-process.php where the plugin returns a generic REST nonce rather than a form-scoped nonce. Form-specific nonces would tie the token to a single form action, limiting its usefulness outside the intended submission flow. By issuing the broadly scoped wp_rest nonce, SureForms turns a shared-secret defense into a public token. Any REST endpoint that treats nonce verification as sufficient authentication is now reachable by attackers.

Attack Vector

Exploitation requires no authentication or user interaction. An attacker sends an HTTP request to the plugin's rest-nonce AJAX action to retrieve a valid nonce. The attacker then attaches that nonce to REST API requests targeting SureForms post-submission hooks or other plugins' endpoints that check only the nonce. This can trigger unauthorized state-changing actions such as form submission processing, background job execution, or hook-driven side effects in other plugins on the same site. The scope depends on which nonce-protected endpoints exist on the target installation.

See the Wordfence Vulnerability Report and the WordPress Plugin File Reference for the vulnerable code paths.

Detection Methods for CVE-2025-12535

Indicators of Compromise

Repeated unauthenticated POST requests to admin-ajax.php with the action=rest-nonce parameter from a small set of source IPs.
Subsequent REST API requests carrying X-WP-Nonce headers immediately following a nonce fetch from the same client.
Unexpected SureForms submission entries, background process jobs, or downstream plugin actions with no matching form-render request in access logs.

Detection Strategies

Correlate wp_ajax_nopriv_rest-nonce calls with subsequent REST endpoint invocations to identify automated abuse patterns.
Alert on any REST API call to nonce-only protected endpoints originating without a preceding page view of the form.
Review WordPress audit logs for form submissions, hook executions, or background jobs lacking normal user-agent and referrer patterns.

Monitoring Recommendations

Enable verbose logging for /wp-admin/admin-ajax.php and /wp-json/ request paths, capturing source IP, nonce header, and action names.
Rate-limit anonymous requests to the nonce-issuing endpoint through a Web Application Firewall (WAF).
Track spikes in unauthenticated REST API traffic and unusual invocation of plugin-registered REST routes.

How to Mitigate CVE-2025-12535

Immediate Actions Required

Update the SureForms plugin to a version later than 1.13.1 once the vendor releases a patched build.
Audit installed plugins for REST endpoints that rely solely on wp_rest nonce checks and add capability or authentication checks.
Deploy WAF rules to block or rate-limit anonymous requests to the rest-nonce AJAX action.

Patch Information

The vendor addressed the issue in a plugin changeset available on WordPress.org. Review the WordPress Plugin Changeset for the code changes and upgrade to the fixed release identified in the Wordfence Vulnerability Report.

Workarounds

Temporarily disable the SureForms plugin on sites that do not require anonymous form submissions until the patch is applied.
Restrict access to admin-ajax.php?action=rest-nonce via server-level rules where public form submission is not needed.
Harden custom and third-party REST endpoints by adding current_user_can() or explicit capability checks in addition to nonce verification.

bash

# Example nginx rule to block anonymous access to the vulnerable AJAX action
location = /wp-admin/admin-ajax.php {
    if ($arg_action = "rest-nonce") {
        return 403;
    }
}