CVE-2025-13696: Zigaform WordPress Information Disclosure

CVE-2025-13696 Overview

CVE-2025-13696 is a sensitive information exposure vulnerability in the Zigaform Calculator & Cost Estimation Form Builder Lite plugin for WordPress. The flaw affects all plugin versions up to and including 7.6.5. The plugin exposes a public AJAX endpoint that returns form submission data without verifying ownership or access rights. Unauthenticated attackers can enumerate sequential form_r_id values through the rocket_front_payment_seesummary action to retrieve submitted data. Exposed data may include personal information, payment details, and other private form responses. The issue is classified as Information Exposure [CWE-200].

Critical Impact
Unauthenticated remote attackers can extract sensitive form submission data — including personal and payment information — by iterating over predictable identifiers.

Affected Products

Zigaform Calculator & Cost Estimation Form Builder Lite for WordPress (versions ≤ 7.6.5)
Vulnerable handler: rocket_front_payment_seesummary AJAX action
Vulnerable source file: modules/formbuilder/controllers/uiform-fb-controller-frontend.php

Discovery Timeline

2025-12-02 - CVE-2025-13696 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-13696

Vulnerability Analysis

The Zigaform plugin registers a public WordPress AJAX endpoint that returns previously submitted form data. The handler processes requests for the rocket_front_payment_seesummary action and returns submission records keyed by a form_r_id parameter. The endpoint does not validate session ownership, capability, or any access token tied to the requested record. Any unauthenticated client can issue requests to wp-admin/admin-ajax.php and receive submission contents that belong to other users.

Because form_r_id values are sequential integers, an attacker can enumerate the full set of stored submissions by incrementing the identifier. Submissions that include personal information, payment details, or other private fields are returned directly in the response body. The vulnerability falls under Information Exposure [CWE-200] and aligns with broken access control patterns common to WordPress plugins exposing wp_ajax_nopriv_* actions.

Root Cause

The root cause is a missing authorization check in the AJAX handler defined at line 106 of uiform-fb-controller-frontend.php. The function retrieves the submission record matching the supplied form_r_id and serializes it to the response without verifying that the requester owns the record, holds a valid nonce, or has any capability granting access. Combining a nopriv AJAX hook with predictable record identifiers makes enumeration trivial.

Attack Vector

An unauthenticated attacker sends crafted HTTP POST requests to the plugin's AJAX endpoint with the action parameter set to rocket_front_payment_seesummary and iterates over form_r_id values. Each successful request returns one stored submission. The attacker scripts the loop to harvest the entire submission table at network speed. No user interaction, authentication, or elevated privileges are required.

For technical details, see the Wordfence Vulnerability Report and the vulnerable handler source.

Detection Methods for CVE-2025-13696

Indicators of Compromise

HTTP POST requests to /wp-admin/admin-ajax.php containing action=rocket_front_payment_seesummary from unauthenticated sources.
Sequential or rapid-fire requests incrementing the form_r_id parameter from a single client IP or distributed botnet.
Large outbound response volume from admin-ajax.php to clients that have no prior authenticated session.

Detection Strategies

Inspect web server access logs for repeated admin-ajax.php POSTs referencing the rocket_front_payment_seesummary action.
Apply a Web Application Firewall (WAF) rule that flags or blocks unauthenticated calls to this action.
Correlate AJAX request volume against unique session cookies to identify enumeration patterns.

Monitoring Recommendations

Alert on bursts of admin-ajax.php traffic returning structured data payloads over a configurable size threshold.
Track 200-OK responses to the affected action grouped by source IP and User-Agent over short time windows.
Forward WordPress access logs to a centralized log platform for retrospective hunting against the action name and parameter pattern.

How to Mitigate CVE-2025-13696

Immediate Actions Required

Update the Zigaform plugin to the version published after 7.6.5 that contains the fix referenced in the vendor commit.
If an update is not yet available in the WordPress repository, disable or remove the Zigaform plugin until patched.
Audit existing form submission storage and notify affected data subjects if exposure is confirmed.

Patch Information

The vendor addressed the issue in a code change committed to the Softdiscover Zigaform repository. Review the GitHub commit and the corresponding WordPress Plugin Changeset for the authorization logic added to the rocket_front_payment_seesummary handler. Install the patched plugin version from the official WordPress plugin directory.

Workarounds

Block requests to wp-admin/admin-ajax.php containing action=rocket_front_payment_seesummary at the WAF or reverse proxy layer until the plugin is updated.
Restrict access to the WordPress AJAX endpoint by IP allowlist where business requirements permit.
Purge unnecessary historical form submissions from the database to limit the dataset exposed during an enumeration attempt.

bash

# Example WAF rule (ModSecurity) to block the vulnerable AJAX action
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,phase:2,deny,status:403,id:1013696,msg:'Block CVE-2025-13696 Zigaform enumeration'"
  SecRule ARGS:action "@streq rocket_front_payment_seesummary"