Unauthorized Data Access in Easy Form Builder Plugin for WordPress

CVE-2025-14067

What is CVE-2025-14067?

The Easy Form Builder plugin for WordPress has a vulnerability that allows authenticated users with Subscriber-level access and higher to access sensitive data. This occurs due to a missing capability check in various AJAX actions, resulting from a logic flaw in the authorization checks. Instead of using the correct logic operator, the plugin uses AND (&&) where OR (||) is necessary, thereby inadvertently permitting unauthorized data retrieval. Attackers can exploit this flaw to gain access to sensitive form response data, including messages and user information.

References