CVE-2025-13696
📋 TL;DR
The Zigaform WordPress plugin exposes sensitive form submission data through an unauthenticated AJAX endpoint. Unauthenticated attackers can extract personal information, payment details, and other private data by enumerating form submission IDs. WordPress sites using Zigaform versions up to 7.6.5 are affected.
💻 Affected Systems
- Zigaform WordPress Plugin
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Mass exfiltration of all form submissions containing sensitive personal data, financial information, and confidential business data, leading to identity theft, financial fraud, and regulatory violations.
Likely Case
Targeted extraction of specific form submissions containing personal identifiable information (PII) and payment details, potentially leading to identity theft and financial loss.
If Mitigated
Limited exposure of non-sensitive form data or complete prevention if proper access controls are implemented.
🎯 Exploit Status
Exploitation requires simple HTTP requests to the vulnerable AJAX endpoint with sequential form_r_id enumeration.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 7.6.6 or later
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find Zigaform plugin. 4. Click 'Update Now' if update is available. 5. Alternatively, download version 7.6.6+ from WordPress plugin repository and manually update.
🔧 Temporary Workarounds
Disable vulnerable AJAX endpoint
allAdd code to WordPress theme's functions.php to block access to the vulnerable rocket_front_payment_seesummary action
add_action('init', function() { if (isset($_REQUEST['action']) && $_REQUEST['action'] === 'rocket_front_payment_seesummary') { wp_die('Access denied'); } });
Web Application Firewall rule
allBlock requests to the vulnerable AJAX endpoint using WAF rules
Block URL pattern: */wp-admin/admin-ajax.php?action=rocket_front_payment_seesummary*
🧯 If You Can't Patch
- Disable the Zigaform plugin immediately
- Implement strict network access controls to limit access to the WordPress admin-ajax.php endpoint
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > Zigaform version. If version is 7.6.5 or lower, the site is vulnerable.Check Version:
wp plugin list --name=zigaform --field=versionVerify Fix Applied:
After updating, verify the plugin version shows 7.6.6 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Multiple GET/POST requests to /wp-admin/admin-ajax.php with action=rocket_front_payment_seesummary parameter
- Unusual spike in requests to admin-ajax.php with form_r_id parameter
Network Indicators:
- HTTP requests containing 'rocket_front_payment_seesummary' in query parameters
- Sequential enumeration patterns in form_r_id parameter values
SIEM Query:
source="web_logs" AND (url="*admin-ajax.php*" AND (query="*action=rocket_front_payment_seesummary*" OR query="*form_r_id=*"))🔗 References
- https://github.com/Softdiscover/Zigaform-WP-Cost-Estimator-Lite/commit/f129d8dd1fb3ab0535c7eb18d52fc49141ab36c8
- https://plugins.trac.wordpress.org/browser/zigaform-calculator-cost-estimation-form-builder-lite/tags/7.6.5/modules/formbuilder/controllers/uiform-fb-controller-frontend.php#L106
- https://plugins.trac.wordpress.org/browser/zigaform-calculator-cost-estimation-form-builder-lite/trunk/modules/formbuilder/controllers/uiform-fb-controller-frontend.php#L106
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3406507%40zigaform-calculator-cost-estimation-form-builder-lite&new=3406507%40zigaform-calculator-cost-estimation-form-builder-lite&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/47f9a466-2826-4835-b06e-14cf4ceb7567?source=cve
