HappyForms <=1.26.12 Authenticated Local File Inclusion Vulnerability Analysis (CVE-2025-11977)

Vulnerability Overview Vulnerability Name: HappyForms <= 1.26.12 - Authenticated (Admin+) Local File Inclusion CVE ID: CVE-2025-11977 CVSS Score: 6.6 (Medium) Published Date: July 9, 2026 Last Updated Date: July 10, 2026 Researcher: Rahul Sreevansan (TrG4n) Affected Products Software Type: Plugin Software Name: Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms Affected Versions: <= 1.26.12 Fixed Version: 1.26.13 Remediation Recommendation: Upgrade to version 1.26.13 or later. Vulnerability Description Vulnerability Type: Improper Control of Filename for Include/Require Statement in PHP Program (PHP Remote File Inclusion) Vulnerability Details: The Happyforms plugin versions 1.26.12 and earlier contain a local file inclusion vulnerability. An attacker can access and execute arbitrary files via the function with administrator-level privileges. This could lead to access control bypasses, sensitive data retrieval, or code execution. References plugins.svn.wordpress.org plugins.svn.wordpress.org plugins.trac.wordpress.org Additional Information Recent Related Vulnerabilities: - Happyforms <= 1.26.13 - Unauthenticated PHP Object Injection (CVE-2026-49768) - Happyforms <= 1.26.2 - Authenticated (Admin+) Stored Cross-Site Scripting (CVE-2024-10054) - Happyforms <= 1.26.0 - Authenticated (Author+) Stored Cross-Site Scripting (CVE-2024-44063) - Happyforms <= 1.25.10 - Missing Authorization (CVE-2024-22521) - Happyforms <= 1.25.9 - Reflected Cross-Site Scripting (CVE-2023-48752) - Happyforms <= 1.21.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Blocks (CVE-2023-0096) Notes Disclaimer: This record contains copyrighted material; specific copyright information can be found at the bottom of the page. Contact Information Technical Support: 9am-6pm ET, 6am-5pm PT, and 2pm-1am UTC/GMT (excluding weekends and holidays) Response Time: 24/7 support with a 1-hour response time Additional Resources Wordfence Intelligence: Offers free personal and commercial API access, as well as the WordPress Vulnerability Database. Wordfence WordPress Plugin: Provides instant notifications of the latest vulnerabilities upon installation. Documentation: Provides documentation for API access and consumption of vulnerability data. Footer Information Terms of Service: Privacy Policy and Notification Collection Social Media: Twitter, Facebook, LinkedIn, Instagram Subscription: Offers news and update subscription services Copyright Information Copyright: © 2012-2026 Defiant Inc. All Rights Reserved Summary This page details a local file inclusion vulnerability in the HappyForms plugin, providing specific vulnerability information, affected scope, remediation steps, and relevant reference links. Users are advised to upgrade to the fixed version as soon as possible to ensure security.

Goal Reached Thanks to every supporter — we hit 100%!

HappyForms <=1.26.12 Authenticated Local File Inclusion Vulnerability Analysis (CVE-2025-11977)

More from this source