{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-9898", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-09-02T23:31:58.184Z", "datePublished": "2025-09-27T06:47:15.058Z", "dateUpdated": "2026-04-08T17:14:47.527Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:14:47.527Z"}, "affected": [{"vendor": "compojoom", "product": "cForms \u2013 Light speed fast Form Builder", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The cForms \u2013 Light speed fast Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.0. This is due to missing or incorrect nonce validation on the cforms_api function. This makes it possible for unauthenticated attackers to modify forms and their settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "title": "cForms \u2013 Light speed fast Form Builder <= 3.0.0 - Cross-Site Request Forgery", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ac23bca5-38dd-4460-83ce-5f7fc8a1f6a0?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/cforms-plugin/trunk/admin/api/form.php#L36"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Nabil Irawan"}], "timeline": [{"time": "2025-09-26T18:34:41.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-29T19:09:45.997105Z", "id": "CVE-2025-9898", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-29T19:09:56.798Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-9898", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-29T19:09:45.997105Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-29T19:09:51.709Z"}}], "cna": {"title": "cForms \u2013 Light speed fast Form Builder <= 3.0.0 - Cross-Site Request Forgery", "credits": [{"lang": "en", "type": "finder", "value": "Nabil Irawan"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "compojoom", "product": "cForms \u2013 Light speed fast Form Builder", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.0.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-09-26T18:34:41.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ac23bca5-38dd-4460-83ce-5f7fc8a1f6a0?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/cforms-plugin/trunk/admin/api/form.php#L36"}], "descriptions": [{"lang": "en", "value": "The cForms \u2013 Light speed fast Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.0. This is due to missing or incorrect nonce validation on the cforms_api function. This makes it possible for unauthenticated attackers to modify forms and their settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:14:47.527Z"}}}, "cveMetadata": {"cveId": "CVE-2025-9898", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:14:47.527Z", "dateReserved": "2025-09-02T23:31:58.184Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-09-27T06:47:15.058Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The cForms \u2013 Light speed fast Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.0. This is due to missing or incorrect nonce validation on the cforms_api function. This makes it possible for unauthenticated attackers to modify forms and their settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "id": "CVE-2025-9898", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2025-09-27T07:15:34.867", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/cforms-plugin/trunk/admin/api/form.php#L36"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ac23bca5-38dd-4460-83ce-5f7fc8a1f6a0?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-20T21:45:35.233232+00:00", "value": {"mitigation_remediation": ["Upgrade the cForms plugin to the latest release that includes the missing nonce validation fix.", "If an immediate update is not possible, restrict access to the cforms_api endpoint so that only administrators can invoke it\u2014e.g., block the endpoint for non\u2011logged\u2011in users or add a role check before processing requests.", "Deploy a security plugin that enforces CSRF tokens on all administrative POST requests, ensuring that even if the plugin remains vulnerable, forged requests are rejected."], "summary": {"action": "Apply Patch", "impact": "Cross\u2011Site Request Forgery"}, "threat_synthesis": {"affected_systems": "The vulnerability exists in all published releases of compojoom's cForms \u2013 Light speed fast Form Builder up to and including version 3.0.0. Users operating those versions should verify the exact edition number and plan remediation.", "description_and_impact": "The cForms \u2013 Light speed fast Form Builder plugin for WordPress is affected by an absence or incorrect nonce validation in its cforms_api function. This flaw permits a malicious actor who sends a forged HTTP request to modify form definitions and their settings, an action that requires an administrator to unknowingly click a crafted link or perform a similar action. The impact is the potential unauthorized alteration of site forms, which can lead to misinformation, defacement, or other integrity violations. The weakness corresponds to CWE\u2011352 \u2013 Cross\u2011Site Request Forgery.", "risk_and_exploitability": "The CVSS score of 4.3 indicates a moderate severity, while the EPSS score of less than 1% suggests exploitation is unlikely at the current time. The flaw is not listed as a known exploited vulnerability by CISA (not in KEV). Based on the description, the likely attack vector is a normal web request from an attacker that the site administrator executes unknowingly. This requires the attacker to entice an authenticated administrator to click a malicious link, after which the forged request modifies the form settings."}}}}, "created": "2025-09-29T09:29:48.126173+00:00", "updated": "2026-04-20T22:00:11.171458+00:00", "vendors": ["compojoom", "compojoom$PRODUCT$cforms", "wordpress", "wordpress$PRODUCT$wordpress"]}