What is the CVSS score of CVE-2025-11977?

CVE-2025-11977 has a CVSS 3.1 base score of 6.6 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Happyforms Plugin CVE-2025-11977

EUVD-2025-210450 MEDIUM

PHP Remote File Inclusion (CWE-98)

2026-07-10 Wordfence

GHSA-f6q8-jxw9-8mhj

WordPress LFI RCE PHP Information Disclosure Happyforms Form Builder For Wordpress

6.6

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.6 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

6.6 MEDIUM

Administrator access required (PR:H) and additional file-upload prerequisite for RCE justifies AC:H; full impact metrics apply only when the upload condition is met.

3.1 AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 10, 2026 - 09:29 vuln.today

CVE Published

Jul 10, 2026 - 07:48 nvd

MEDIUM 6.6

DescriptionCVE.org

The Happyforms - Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.26.12 via the happyforms_get_form_partial() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.

AnalysisAI

Local File Inclusion in the Happyforms WordPress plugin (all versions through 1.26.12) allows authenticated administrators to include and execute arbitrary PHP files on the server via the happyforms_get_form_partial() function, enabling full remote code execution when the attacker can also upload PHP files. The vulnerability is rooted in unsanitized filename handling (CWE-98) within the form template rendering logic, as evidenced by the affected files class-wp-customize-form-manager.php and helper-form-templates.php. No public exploit code or CISA KEV listing has been identified at time of analysis, and the Administrator-level access prerequisite substantially limits the realistic attacker population.

Technical ContextAI

CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program) describes a classic PHP file inclusion flaw where user-controllable input is passed to a PHP include/require construct without adequate path validation. In this case, the happyforms_get_form_partial() function - invoked during form template rendering in the WordPress Customizer and front-end form handling code - accepts a parameter that is used to resolve a PHP partial file. The affected codebase paths (core/classes/class-wp-customize-form-manager.php and core/helpers/helper-form-templates.php) indicate the flaw spans both the WP Customizer integration and the template helper layer. The CPE string confirms the affected product is the Happyforms WordPress plugin. Because the inclusion target is a .php file, the PHP interpreter executes the included file rather than merely reading it, elevating an LFI to RCE when a writable upload path exists.

RemediationAI

A fix was committed to the WordPress.org SVN repository (changeset 3494912: https://plugins.trac.wordpress.org/changeset?reponame=&old=3494912%40happyforms&new=3494912%40happyforms); however, the exact released version number corresponding to this patch is not confirmed in the available data. Site administrators should update the Happyforms plugin to the latest available version via the WordPress plugin dashboard and verify the installed version exceeds 1.26.12. As a compensating control pending patch deployment, administrators should restrict the WordPress admin panel to trusted IP ranges and disable PHP file uploads in directories accessible to WordPress (e.g., via server-level configuration blocking PHP execution in wp-content/uploads). Note that blocking PHP execution in upload directories only mitigates the RCE escalation path; the underlying LFI remains exploitable by existing admin-level accounts. The Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/e31119ab-963d-48a4-9948-0a0dce761918) should be monitored for confirmation of the patched release version.