CVE-2025-0939 describes a missing authorization vulnerability in the MagicForm WordPress plugin by dcooperman. The flaw exists in the plugin's AJAX actions, which lack proper capability checks, allowing authenticated users with low privileges (Subscriber-level and above) to perform unauthorized actions such as deleting or viewing logs, modifying forms, and changing plugin settings. This vulnerability affects all versions up to and including 1.6.2. The CVSS 3.1 base score is 6.3, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.

An attacker with authenticated Subscriber-level access or higher can exploit this vulnerability to access and modify sensitive plugin data, including logs and forms, and alter plugin settings. This can lead to unauthorized data disclosure, data modification, and potential disruption of plugin functionality. The impact affects confidentiality, integrity, and availability of the plugin's data and operations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles to trusted individuals only and monitor for suspicious activity related to MagicForm plugin AJAX actions. Avoid granting Subscriber-level or higher access to untrusted users. Follow vendor updates closely for any released patches or official mitigation instructions.