Cross-Site Request Forgery Vulnerability in cForms Plugin for WordPress

CVE-2025-9898

What is CVE-2025-9898?

The cForms – Light speed fast Form Builder plugin for WordPress contains a vulnerability that allows unauthenticated attackers to exploit missing or incorrect nonce validation in the cforms_api function. This could enable attackers to issue forged requests to modify forms and their configurations if they can deceive a site administrator into inadvertently triggering such an action, such as clicking on a malicious link. This flaw highlights the necessity for robust nonce validation mechanisms to protect against unauthorized changes to web forms.

References