CVE-2025-11977

Name of the Vulnerable Software and Affected Versions Happyforms – Form Builder for WordPress versions prior to 1.26.13

Description The plugin is subject to Local File Inclusion, a condition where an application includes files from the local file system without proper validation. This occurs through the happyforms get form partial() function, allowing authenticated attackers with Administrator-level access or higher to include and execute arbitrary .php files on the server. This can lead to the execution of arbitrary PHP code, bypassing access controls, and the theft of sensitive data, particularly if .php files can be uploaded to the server.

Recommendations Update the plugin to a version newer than 1.26.12. As a temporary mitigation, restrict access to the happyforms get form partial() function.