CVE-2025-13696

Description

The Zigaform plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 7.6.5. This is due to the plugin exposing a public AJAX endpoint that retrieves form submission data without performing authorization checks to verify ownership or access rights. This makes it possible for unauthenticated attackers to extract sensitive form submission data including personal information, payment details, and other private data via the rocket_front_payment_seesummary action by enumerating sequential form_r_id values.

PUBLISHED Reserved 2025-11-25 | Published 2025-12-02 | Updated 2025-12-02 | Assigner Wordfence

Problem types

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Product status

Timeline

Credits

Md. Moniruzzaman Prodhan finder

References

www.wordfence.com/...-2826-4835-b06e-14cf4ceb7567?source=cve

plugins.trac.wordpress.org/...orm-fb-controller-frontend.php

plugins.trac.wordpress.org/...orm-fb-controller-frontend.php

plugins.trac.wordpress.org/...der-lite&sfp_email=&sfph_mail=

github.com/...ommit/f129d8dd1fb3ab0535c7eb18d52fc49141ab36c8

cve.org (CVE-2025-13696)

nvd.nist.gov (CVE-2025-13696)

Download JSON