What is the CVSS score of CVE-2025-47527?

CVE-2025-47527 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H. EPSS exploitation probability: 0.1%.

Which versions of Wordpress Plugin are affected by CVE-2025-47527?

Organizations using the Icegram Collect plugin (versions up to 1.3.18) are exposed to unauthorized access vulnerabilities that could allow attackers to bypass access controls and access sensitive…

How to fix or mitigate CVE-2025-47527?

Within 24 hours: Identify all WordPress installations using Icegram Collect plugin and document affected versions. Within 7 days: Implement network segmentation to restrict form endpoints, apply WAF rules to block suspicious access patterns to form submission endpoints, and disable Icegram forms temporarily if possible. Within 30 days: Monitor vendor communication for patch availability and plan immediate deployment upon release; consider alternative form collection solutions if patch timeline is unclear.

Wordpress Plugin CVE-2025-47527

EUVD-2025-17519 HIGH

Missing Authorization (CWE-862)

2025-06-09 audit@patchstack.com

WordPress Authentication Bypass Wordpress Plugin

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

EUVD ID Assigned

Mar 14, 2026 - 19:21 euvd

EUVD-2025-17519

Analysis Generated

Mar 14, 2026 - 19:21 vuln.today

CVE Published

Jun 09, 2025 - 16:15 nvd

HIGH 7.1

DescriptionCVE.org

Missing Authorization vulnerability in Icegram Icegram Collect - Easy Form, Lead Collection and Subscription plugin allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Icegram Collect - Easy Form, Lead Collection and Subscription plugin: from n/a through 1.3.18.

AnalysisAI

Missing Authorization vulnerability (CWE-862) in the Icegram Collect WordPress plugin versions up to 1.3.18 that allows authenticated attackers with low privileges to exploit misconfigured access controls. An attacker with a valid WordPress user account can modify or delete form data and potentially cause service disruption by leveraging inadequate authorization checks on sensitive operations, with no confidentiality impact but significant integrity and availability risks.

Technical ContextAI

This vulnerability exists in the Icegram Collect – Easy Form, Lead Collection and Subscription WordPress plugin, which provides form building and lead collection functionality for WordPress sites. The root cause is CWE-862 (Missing Authorization), indicating that the plugin fails to properly verify whether an authenticated user has the necessary permissions before allowing them to perform sensitive actions. The plugin likely implements WordPress authentication but does not correctly validate authorization at the application logic level, allowing any logged-in user (regardless of role) to access or modify restricted form data, submissions, or configurations. This is distinct from authentication bypass—the user must be logged in—but represents a broken access control implementation common in WordPress plugins that don't properly check user capabilities before CRUD operations.

RemediationAI

Update plugin via WordPress Admin > Plugins > Updates or download from wordpress.org/plugins/icegram-forms/ Workaround (Temporary): WordPress Admin > Users > Edit roles and capabilities to remove form_submission access for lower-privilege roles Mitigation: Enable audit logging and set up alerts for form data modifications by non-admin users Vendor Advisory: Monitor: wordpress.org/plugins/icegram-forms/ and icegram.com for patch announcements