CVE-2025-62109: 
WordPress vulnerability analysis and mitigation

CVE-2025-62109 is a Sensitive Data Exposure vulnerability (CWE-201: Insertion of Sensitive Information Into Sent Data) affecting the INFINITUM FORM Geo Controller WordPress plugin (slug: cf-geoplugin) in all versions through 8.9.4. The vulnerability allows unauthenticated remote attackers to retrieve embedded sensitive data. It was reported by researcher Nabil Irawan on October 9, 2025, and published by Patchstack on November 8, 2025, with CVE assignment and NVD publication on December 9, 2025. The NVD assigns a CVSS v3.1 base score of 7.5 (High), while Patchstack rates it 5.3 (Medium) using a WordPress-contextualized scoring approach (Patchstack).

The vulnerability is classified under CWE-201 (Insertion of Sensitive Information Into Sent Data), meaning the plugin inadvertently includes sensitive data in responses sent to unauthenticated users. The attack vector is network-based, requires no authentication, no user interaction, and low attack complexity, making it trivially exploitable by any remote actor. The flaw maps to OWASP Top 10 category A3: Sensitive Data Exposure, and the sensitive information exposed could potentially be leveraged to facilitate further attacks against the WordPress installation or its users (Patchstack).

Successful exploitation allows an unauthenticated attacker to retrieve sensitive information that is normally restricted from regular users, with a high confidentiality impact and no integrity or availability impact. The exposed data could be used to identify further weaknesses in the system or facilitate secondary attacks against the WordPress site or its users. Patchstack notes that vulnerabilities of this type are commonly used in mass-exploit campaigns targeting thousands of WordPress sites regardless of their size or popularity (Patchstack).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack classifies the priority as "Low" and considers it unlikely to be exploited, though the unauthenticated, network-accessible nature of the flaw means it could be incorporated into automated WordPress scanning tools (Patchstack).

As of the time of disclosure, no official patch from the plugin developer (INFINITUM FORM) was available for versions through 8.9.4. Site administrators should monitor the WordPress plugin repository for an updated version of Geo Controller (cf-geoplugin) and apply it immediately upon release. In the interim, disabling or removing the plugin is the most effective workaround. Patchstack users with virtual patching enabled receive automatic protection against this vulnerability (Patchstack).