Unauthorized Data Access in WS Form LITE by WordPress
CVE-2025-3912
5.3MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 25 April 2025
What is CVE-2025-3912?
The WS Form LITE plugin for WordPress presents a significant security issue due to a missing capability check on the 'get_config' function. This vulnerability allows unauthenticated attackers to gain unauthorized access to sensitive plugin settings, including API keys for integrated services. Such exposure heightens the risk of further exploitation, potentially leading to unauthorized actions or breaches within the website.
Affected Version(s)
WS Form LITE – Drag & Drop Contact Form Builder for WordPress * <= 1.10.35