CVE-2025-30809: Live Forms Auth Bypass Vulnerability

CVE-2025-30809 Overview

CVE-2025-30809 is a Missing Authorization vulnerability [CWE-862] in the Shahjada Live Forms plugin for WordPress, also known as liveforms. The flaw affects all versions up to and including 4.8.4. The plugin fails to enforce proper access control checks, allowing authenticated users with low privilege levels to modify plugin settings they should not be able to access.

The root cause is incorrectly configured access control security levels on plugin endpoints. An attacker with a valid low-privilege account on the target WordPress site can send crafted requests to settings-change endpoints that lack capability or role verification.

Critical Impact
Authenticated attackers can alter Live Forms plugin settings, affecting form behavior and site integrity.

Affected Products

Shahjada Live Forms (liveforms) WordPress plugin
All versions from n/a through 4.8.4
WordPress sites using the Contact Form Drag and Drop Form Builder Plugin by Live Forms

Discovery Timeline

2025-03-27 - CVE-2025-30809 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30809

Vulnerability Analysis

The Live Forms plugin exposes settings-modification functionality through endpoints that do not verify the caller's capabilities. WordPress plugins must call current_user_can() or equivalent capability checks before executing privileged actions. The Live Forms codebase omits these checks on at least one settings handler through version 4.8.4.

This is a Broken Access Control weakness categorized under CWE-862 Missing Authorization. The impact is bounded by the plugin's configuration surface, which affects form definitions, submission routing, and plugin behavior. An attacker could reroute submissions, disable validation, or alter notification destinations.

Root Cause

The plugin processes administrative requests without enforcing role-based authorization. WordPress supplies nonce verification and capability checks as separate controls, and both are required for sensitive actions. The Live Forms handler relies on authentication alone and does not confirm the acting user has manage_options or an equivalent capability.

Attack Vector

Exploitation requires an authenticated session on the target WordPress site at any role level, including Subscriber. The attacker sends an HTTP request to the vulnerable plugin endpoint with the parameters needed to modify settings. No user interaction from an administrator is required.

See the Patchstack Vulnerability Report for the full technical write-up and parameter details.

Detection Methods for CVE-2025-30809

Indicators of Compromise

Unexpected changes to Live Forms plugin configuration recorded in WordPress audit logs or database wp_options entries.
POST requests to admin-ajax.php or Live Forms REST routes originating from low-privilege user sessions.
Modified form notification email addresses or redirect URLs that do not match administrator-approved values.

Detection Strategies

Review WordPress access logs for authenticated requests to Live Forms administrative endpoints from non-administrator accounts.
Monitor the wp_options table for unauthorized writes to Live Forms configuration keys.
Compare current plugin settings against a known-good baseline to identify drift.

Monitoring Recommendations

Enable a WordPress activity log plugin to capture settings changes with user attribution.
Alert on HTTP 200 responses to Live Forms settings endpoints from Subscriber or Contributor role sessions.
Track plugin version inventory across managed WordPress instances to confirm patch deployment.

How to Mitigate CVE-2025-30809

Immediate Actions Required

Update the Live Forms plugin to a version later than 4.8.4 once the vendor publishes a fixed release.
Audit existing user accounts and remove unused low-privilege accounts that could be leveraged for exploitation.
Review current Live Forms plugin settings and restore any unauthorized changes.

Patch Information

At the time of CVE publication, the vulnerability affects all versions up to and including 4.8.4. Refer to the Patchstack Vulnerability Report for the latest patched version and upgrade guidance.

Workarounds

Deactivate the Live Forms plugin until an updated version is available if settings integrity cannot be verified.
Restrict user registration to trusted parties and disable open registration on affected sites.
Deploy a Web Application Firewall rule that blocks requests to Live Forms settings endpoints from sessions lacking the administrator role.

bash

# Configuration example
# Disable open user registration in wp-config.php or Settings > General
update_option( 'users_can_register', 0 );

# Temporarily deactivate the vulnerable plugin via WP-CLI
wp plugin deactivate liveforms