CVE-2025-67577
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
The Easy Form Builder plugin (by hassantafreshi) contains a Missing Authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects Easy Form Builder from n/a through <= 3.8.20.
Risk Assessment
The risk is that unauthorized users may gain access to functions or data that should be protected, which could lead to a breach of confidentiality or integrity of the system.
Recommendation
It is recommended to update the Easy Form Builder plugin to the latest version that includes a fix for this vulnerability.
Other vulnerabilities in Easy Form Builder
See all- CVE-2026-42747Critical
CVE-2026-42747 describes an improper neutralization of special elements used in SQL commands, leading to a Blind SQL Injection vulnerability in Easy Form Builder. This issue affects versions from n/a through 4.0.6.
- CVE-2026-59517High
The Easy Form Builder plugin version 4.0.12 and earlier contains a Cross Site Scripting (XSS) vulnerability without requiring authentication. An attacker can inject malicious JavaScript code into the page.
Original NVD description (English source)
Missing Authorization vulnerability in hassantafreshi Easy Form Builder easy-form-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Form Builder: from n/a through <= 3.8.20.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS