WordPress Plugin Vulnerabilities

Ninja Forms < 3.12.1 - Limited File Deletion via CSRF

Description

The plugin is vulnerable to Cross-Site Request Forgery due to missing or incorrect nonce validation when exporting CSV files. This makes it possible for unauthenticated attackers to delete those files granted they can trick an administrator into performing an action such as clicking on a link.

Affects Plugins

Plugin icon
ninja-forms
Fixed in 3.12.1

References

CVE
CVE-2025-10498
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/b082176c-9486-416c-8215-cdba4d6e5260

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Nguyen Ngoc Quang Bach (maysbachs)
Verified
No
WPVDB ID
fed8ab88-a835-4bf8-9f26-b754883d8745

Timeline

Publicly Published
2025-09-26 (about 1 year ago)
Added
2025-09-28 (about 1 year ago)
Last Updated
2025-09-28 (about 1 year ago)

Other

Published
Title
Published
2015-09-07
Title
Contact Form Generator < 2.5.5 - Multiple Cross-Site Request Forgery (CSRF)
Published
2022-06-15
Title
Photo Gallery by Supsystic < 1.15.6 - Arbitrary Settings Update via CSRF
Published
2022-10-28
Title
My wpdb < 2.5 - Arbitrary SQL Query via CSRF
Published
2014-08-01
Title
Related Posts 2.7.1 - Cross-Site Request Forgery
Published
2025-03-31
Title
AB Google Map Travel <= 4.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting