CVE-2025-13696 is a vulnerability in the Zigaform WordPress plugin that allows unauthorized access to sensitive form submission data. The issue arises because the plugin exposes a public AJAX endpoint (rocket_front_payment_seesummary) that retrieves form data without verifying if the requester is authorized to view it. Attackers can exploit this by enumerating sequential form_r_id values to extract personal information, payment details, and other private data. The vulnerability affects versions up to and including 7.6.5 and does not require authentication or user interaction to exploit.

An unauthenticated attacker can access sensitive information submitted through forms, including personal and payment data, without any authorization checks. This exposure can lead to privacy violations and potential misuse of the extracted data. There is no indication of impact on data integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently provided. Until a patch is available, restrict access to the AJAX endpoint if possible or implement custom authorization checks to prevent unauthorized data access.