CVE-2025-11977: HappyForms <= 1.26.12 - Authenticated (Admin+) Local File Inclusion
The Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.26.12 via the happyformsgetformpartial() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-11977?
The severity of CVE-2025-11977 is classified as medium with a score of 6.6.
How do I fix CVE-2025-11977?
To fix CVE-2025-11977, update the HappyForms plugin to version 1.26.13 or later.
What type of vulnerability is CVE-2025-11977?
CVE-2025-11977 is an Authenticated Local File Inclusion vulnerability.
Who is affected by CVE-2025-11977?
CVE-2025-11977 affects all users of HappyForms versions up to and including 1.26.12.
What can attackers do exploiting CVE-2025-11977?
Attackers can exploit CVE-2025-11977 to include and execute files on the server due to a lack of proper validation.