CVE-2025-3912: WS Form LITE Information Disclosure Flaw

CVE-2025-3912 Overview

CVE-2025-3912 affects the WS Form LITE – Drag & Drop Contact Form Builder plugin for WordPress. The vulnerability exists in the get_config function, which lacks a capability check across all versions up to and including 1.10.35. Unauthenticated attackers can read the plugin's configuration data, including API keys for integrated third-party services. The flaw is categorized as Missing Authorization [CWE-862]. Exposure of API credentials can enable pivoting to connected services such as email, CRM, or payment providers used by the WordPress site.

Critical Impact
Unauthenticated remote attackers can retrieve plugin configuration data and API keys, enabling downstream compromise of integrated services.

Affected Products

WS Form LITE – Drag & Drop Contact Form Builder for WordPress, versions up to and including 1.10.35
WordPress sites with WS Form LITE installed and activated
Any integrated third-party service whose API keys are stored in the plugin configuration

Discovery Timeline

2025-04-25 - CVE-2025-3912 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-3912

Vulnerability Analysis

The vulnerability resides in the get_config function of the WS Form LITE plugin. WordPress plugins are expected to enforce capability checks such as current_user_can() before returning administrative data. In WS Form LITE versions up to 1.10.35, this check is absent on the get_config endpoint. As a result, any unauthenticated HTTP client can invoke the function and receive the plugin's stored settings.

The returned configuration payload includes API keys for services the site owner has integrated with WS Form, such as mail delivery, marketing, and CRM platforms. An attacker who harvests these keys can authenticate to those third-party services outside the WordPress boundary. This shifts the impact from a single site to any downstream account tied to the exposed credentials. The Wordfence advisory and the WordPress plugin trac references document the impacted code paths in class-ws-form-api.php, class-ws-form-common.php, and class-ws-form-config.php.

Root Cause

The root cause is a missing authorization check [CWE-862] on a function that returns sensitive configuration data. The handler executes without validating the caller's WordPress role or capability, treating anonymous requests the same as administrator requests.

Attack Vector

Exploitation requires only network access to the WordPress site. An attacker sends a crafted HTTP request to the WS Form endpoint that invokes get_config. No authentication, user interaction, or elevated privileges are required. The response body contains the plugin configuration, which the attacker parses to extract API keys and integration secrets.

No verified public exploit code is available. The vulnerability mechanism is documented in the Wordfence Vulnerability Analysis and the WordPress Changeset #3280355 that resolves the issue.

Detection Methods for CVE-2025-3912

Indicators of Compromise

Anonymous HTTP requests to WS Form API endpoints that invoke the get_config action, particularly from unfamiliar IP addresses or automated scanners
Outbound authentication attempts to integrated third-party services from IP addresses that do not match the site's normal infrastructure
Unexpected activity on API keys tied to services integrated with WS Form, such as email sending spikes or CRM record enumeration

Detection Strategies

Review WordPress and web server access logs for requests targeting WS Form API routes with no accompanying authentication cookie or nonce
Compare the installed WS Form LITE version against 1.10.35 across all managed WordPress sites and flag vulnerable instances
Correlate WordPress request logs with third-party service audit logs to identify credential misuse originating from a leaked configuration

Monitoring Recommendations

Enable verbose logging on the WordPress REST API and admin-ajax endpoints, and forward logs to a centralized SIEM for retention and query
Alert on repeated unauthenticated calls to plugin endpoints, especially those returning large JSON payloads
Monitor third-party service dashboards for anomalous API usage, and rotate keys if the plugin was running a vulnerable version

How to Mitigate CVE-2025-3912

Immediate Actions Required

Update WS Form LITE to a version later than 1.10.35 that includes the fix from WordPress Changeset #3280355
Rotate every API key and integration secret stored in the WS Form configuration, since these values must be treated as disclosed
Audit third-party service logs for unauthorized access using the previously stored credentials

Patch Information

The vendor addressed the issue in the WS Form plugin repository via WordPress Changeset #3280355. The fix adds the missing capability check to the get_config function so only authorized users can retrieve plugin configuration. Site administrators should apply the update through the WordPress plugin dashboard or by pulling the latest release from the plugin's source repository.

Workarounds

Deactivate and remove WS Form LITE until the patched version is applied if immediate updating is not possible
Restrict access to WordPress REST API and admin-ajax endpoints at the web application firewall or reverse proxy layer
Remove sensitive API keys from the plugin configuration and store integration credentials only in services that enforce their own access control

bash

# Configuration example
# Verify the installed WS Form LITE version on a WordPress host
wp plugin get ws-form-lite --field=version

# Update the plugin to the patched release
wp plugin update ws-form-lite