CVE-2025-67577
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
The Easy Form Builder plugin (by hassantafreshi) contains a Missing Authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects Easy Form Builder from n/a through <= 3.8.20.
Risk Assessment
The risk is that unauthorized users may gain access to functions or data that should be protected, which could lead to a breach of confidentiality or integrity of the system.
Recommendation
It is recommended to update the Easy Form Builder plugin to the latest version that includes a fix for this vulnerability.
Other vulnerabilities in Easy Form Builder
See all- CVE-2026-59517High
The Easy Form Builder plugin version 4.0.12 and earlier contains a Cross Site Scripting (XSS) vulnerability without requiring authentication. An attacker can inject malicious JavaScript code into the page.
- CVE-2026-42747Critical
CVE-2026-42747 describes an improper neutralization of special elements used in SQL commands, leading to a Blind SQL Injection vulnerability in Easy Form Builder. This issue affects versions from n/a through 4.0.6.
Original NVD description (English source)
Missing Authorization vulnerability in hassantafreshi Easy Form Builder easy-form-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Form Builder: from n/a through <= 3.8.20.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS