Happyforms Plugin CVE-2025-11977

Exploitation requires an authenticated WordPress account with Administrator-level privileges (PR:H confirmed by CVSS vector). For full remote code execution, the attacker must additionally be able to place a PHP file in a server path reachable by the include statement - typically via WordPress media upload, theme/plugin file editing, or a separately chained file-write vulnerability. Without an uploadable PHP file, the attacker is limited to including existing server-side PHP files, which can still expose sensitive data such as wp-config.php credentials. Limiting factors: the Administrator role is required (standard editor/author/subscriber accounts cannot trigger the flaw), AC:H reflects the additional file-placement prerequisite for RCE, and the vulnerability does not affect unauthenticated users or lower-privileged roles. Non-default conditions: the attacker must control an admin account and have a means to place a PHP file on the server filesystem.

The official CVSS 3.1 score of 6.6 (Medium) accurately reflects the constrained attack surface: AV:N acknowledges the web-accessible vector, but PR:H (Administrator privilege required) and AC:H (additional complexity - namely, the need to upload a PHP file for full RCE) combine to make this a low-probability attack path in practice. A WordPress site administrator who can already upload files to the server has many other avenues to achieve code execution, which means this vulnerability primarily matters in environments where administrative accounts are compromised by a third party or where privilege escalation is being chained. No EPSS data was provided, and the absence of a KEV listing and no reported POC further support a realistic risk posture that is lower than the C:H/I:H/A:H impact metrics suggest in isolation. The most plausible real-world scenario is post-compromise persistence or privilege escalation rather than initial access. The CVSS vector is internally consistent with the description; no conflicting signals identified.

A threat actor who has obtained WordPress Administrator credentials - through credential stuffing, phishing, or a separate account takeover - uploads a PHP webshell to the server via the WordPress media library or theme editor, then crafts a request to the Happyforms form rendering flow that passes the webshell path as the partial template parameter to happyforms_get_form_partial(), causing the PHP interpreter to execute the attacker-controlled file and establish persistent server-level access. No public POC has been identified, so the attack requires manual exploitation knowledge of the specific function's parameter handling.