CVE-2025-3912
CVSS 3.1 Score 5.3 of 10 (medium)
Details
Published Apr 25, 2025
Updated: Apr 29, 2025
CWE ID 862
Summary
CVE-2025-3912: The WS Form LITE plugin for WordPress, versions up to 1.10.35, is vulnerable to unauthorized data access due to a missing capability check. This issue allows unauthenticated attackers to read sensitive information, such as plugin settings and API keys for integrated services. The 'get_config' function is the source of the vulnerability, making it crucial for users to upgrade to a patched version as soon as possible to mitigate the risk.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.