What is the CVSS score of CVE-2025-67570?

CVE-2025-67570 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

PHP CVE-2025-67570

Q: Which versions of PHP are affected by CVE-2025-67570?

WPForms Google Sheet Connector plugin through version 4.0.0 allows unauthenticated remote attackers to modify data by exploiting missing authorization checks on access control mechanisms.

MEDIUM

Missing Authorization (CWE-862)

2025-12-09 audit@patchstack.com

WordPress PHP Authentication Bypass

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 01, 2026 - 15:22 vuln.today

CVE Published

Dec 09, 2025 - 16:18 nvd

MEDIUM 5.3

DescriptionCVE.org

Missing Authorization vulnerability in WesternDeal WPForms Google Sheet Connector gsheetconnector-wpforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPForms Google Sheet Connector: from n/a through <= 4.0.0.

AnalysisAI

WPForms Google Sheet Connector plugin through version 4.0.0 allows unauthenticated remote attackers to modify data by exploiting missing authorization checks on access control mechanisms. The vulnerability enables unauthorized manipulation of form submissions and Google Sheet integrations without proper permission validation, affecting WordPress installations using this plugin.

Technical ContextAI

The vulnerability stems from CWE-862 (Missing Authorization), where the WPForms Google Sheet Connector plugin fails to implement proper access control validation on administrative or sensitive operations. The plugin integrates WPForms (a popular WordPress form builder) with Google Sheets, creating a data pipeline that requires strict authorization checks. The lack of proper permission enforcement means that unauthenticated users can send requests that modify form data or sheet configurations without verifying user roles or capabilities. This is a classic broken access control issue where the application trusts user input without validating whether the requestor has legitimate authority to perform the action.

Affected ProductsAI

WesternDeal WPForms Google Sheet Connector (gsheetconnector-wpforms) versions from an unspecified baseline through version 4.0.0 are affected. This is a WordPress plugin available via the official WordPress plugin repository, as referenced in the Patchstack vulnerability database entry.

RemediationAI

Update the WPForms Google Sheet Connector plugin to a version after 4.0.0 immediately. Administrators should navigate to WordPress admin dashboard, go to Plugins, and update gsheetconnector-wpforms to the latest available version from the WordPress.org plugin repository. If an update beyond 4.0.0 is not yet available, disable the plugin temporarily until a patched version is released. Review Google Sheets API permissions and ensure that the plugin's service account has minimal required scopes. Additionally, implement WordPress security best practices such as disabling REST API endpoints if not needed and using capability checks in custom code. See Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/gsheetconnector-wpforms/vulnerability/wordpress-wpforms-google-sheet-connector-plugin-4-0-0-broken-access-control-vulnerability for detailed remediation.