Sensitive Information Exposure in Zigaform Plugin for WordPress

CVE-2025-13696

What is CVE-2025-13696?

The Zigaform plugin for WordPress has a vulnerability that allows unauthenticated attackers to access sensitive information through an unsecured public AJAX endpoint. Specifically, versions up to and including 7.6.5 lack proper authorization checks, permitting attackers to retrieve private form submission data, which may include personally identifiable information and payment details, by sequentially enumerating form submission IDs. This significant exposure can lead to data leaks, impacting both users and website owners, hence immediate action is recommended to secure the plugin.

References