CVE-2025-67570

MEDIUM
2025-12-09 [email protected]
5.3
CVSS 3.1
Share

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None

Lifecycle Timeline

2
Analysis Generated
Apr 01, 2026 - 15:22 vuln.today
CVE Published
Dec 09, 2025 - 16:18 nvd
MEDIUM 5.3

Tags

WordPress PHP Authentication Bypass

Description

Missing Authorization vulnerability in WesternDeal WPForms Google Sheet Connector gsheetconnector-wpforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPForms Google Sheet Connector: from n/a through <= 4.0.0.

Analysis

WPForms Google Sheet Connector plugin through version 4.0.0 allows unauthenticated remote attackers to modify data by exploiting missing authorization checks on access control mechanisms. The vulnerability enables unauthorized manipulation of form submissions and Google Sheet integrations without proper permission validation, affecting WordPress installations using this plugin.

Technical Context

The vulnerability stems from CWE-862 (Missing Authorization), where the WPForms Google Sheet Connector plugin fails to implement proper access control validation on administrative or sensitive operations. The plugin integrates WPForms (a popular WordPress form builder) with Google Sheets, creating a data pipeline that requires strict authorization checks. The lack of proper permission enforcement means that unauthenticated users can send requests that modify form data or sheet configurations without verifying user roles or capabilities. This is a classic broken access control issue where the application trusts user input without validating whether the requestor has legitimate authority to perform the action.

Affected Products

WesternDeal WPForms Google Sheet Connector (gsheetconnector-wpforms) versions from an unspecified baseline through version 4.0.0 are affected. This is a WordPress plugin available via the official WordPress plugin repository, as referenced in the Patchstack vulnerability database entry.

Remediation

Update the WPForms Google Sheet Connector plugin to a version after 4.0.0 immediately. Administrators should navigate to WordPress admin dashboard, go to Plugins, and update gsheetconnector-wpforms to the latest available version from the WordPress.org plugin repository. If an update beyond 4.0.0 is not yet available, disable the plugin temporarily until a patched version is released. Review Google Sheets API permissions and ensure that the plugin's service account has minimal required scopes. Additionally, implement WordPress security best practices such as disabling REST API endpoints if not needed and using capability checks in custom code. See Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/gsheetconnector-wpforms/vulnerability/wordpress-wpforms-google-sheet-connector-plugin-4-0-0-broken-access-control-vulnerability for detailed remediation.

Priority Score

27
Low Medium High Critical
KEV: 0
EPSS: +0.0
CVSS: +26
POC: 0

Share

CVE-2025-67570 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy