CVE-2025-11977
MediumCVSS 6.6Exploitation Probability (EPSS)
Elevated risk57th percentile - higher than 57% of all known CVEs
Summary
The Happyforms plugin for WordPress up to version 1.26.12 is vulnerable to Local File Inclusion (LFI) via the happyforms_get_form_partial() function. This allows authenticated attackers with Administrator-level access or higher to include and execute arbitrary .php files on the server.
Risk Assessment
The risk includes bypassing access controls, obtaining sensitive data, and achieving code execution, especially if .php files can be uploaded and included.
Recommendation
Immediately update the Happyforms plugin to the latest available version that fixes this vulnerability. Restrict access to the WordPress admin panel to trusted users only.
Other vulnerabilities in Happyforms
See allOriginal NVD description (English source)
The Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.26.12 via the happyforms_get_form_partial() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS