What is the CVSS score of CVE-2025-67468?

CVE-2025-67468 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

cf7-salesforce WordPress plugin CVE-2025-67468

MEDIUM

Missing Authorization (CWE-862)

2025-12-09 audit@patchstack.com

WordPress Authentication Bypass Wordpress Plugin

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Requires low-privileged user account; low complexity, no user interaction, only confidentiality impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 17:41 vuln.today

DescriptionCVE.org

Missing Authorization vulnerability in CRM Perks Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms cf7-salesforce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms: from n/a through <= 1.4.6.

AnalysisAI

Unauthorized data access in the cf7-salesforce WordPress plugin (Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms) up to version 1.4.6 allows low-privileged authenticated users to view sensitive information. The missing authorization vulnerability enables attackers with subscriber-level access to bypass access control security levels and access data they should not see. No active exploitation or public exploit has been identified, and the EPSS probability is very low.

Technical ContextAI

The vulnerability stems from missing authorization checks (CWE-862) in the plugin, which integrates Salesforce with multiple WordPress form builders. By lacking proper capability checks on certain endpoints, the plugin fails to enforce access control, allowing users with low privileges to perform unauthorized data access. The CVSS vector indicates a network-accessible attack with low complexity, requiring only low-level authentication, and results solely in a loss of confidentiality.

Affected ProductsAI

The WordPress plugin 'Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms' (slug cf7-salesforce) versions n/a through 1.4.6 inclusive are affected, as reported by Patchstack. No exact CPE is available, but the official advisory is at https://patchstack.com/database/Wordpress/Plugin/cf7-salesforce/vulnerability/wordpress-integration-for-salesforce-and-contact-form-7-wpforms-elementor-formidable-ninja-forms-plugin-1-4-6-broken-access-control-vulnerability?_s_id=cve.

RemediationAI

No patched version has been confirmed at the time of analysis. Users should immediately check the plugin's changelog or the developer's site for an updated version that addresses the access control issue. Until a fix is available, as a compensating control, restrict the plugin's admin pages and associated REST/AJAX endpoints to administrator roles only via custom code or a security plugin; disabling the plugin entirely is also a viable temporary measure, though it will interrupt all Salesforce integrations.