CVE-2025-47527

This vulnerability exists in the Icegram Collect – Easy Form, Lead Collection and Subscription WordPress plugin, which provides form building and lead collection functionality for WordPress sites. The root cause is CWE-862 (Missing Authorization), indicating that the plugin fails to properly verify whether an authenticated user has the necessary permissions before allowing them to perform sensitive actions. The plugin likely implements WordPress authentication but does not correctly validate authorization at the application logic level, allowing any logged-in user (regardless of role) to access or modify restricted form data, submissions, or configurations. This is distinct from authentication bypass—the user must be logged in—but represents a broken access control implementation common in WordPress plugins that don't properly check user capabilities before CRUD operations.