Unauthorized Data Access in Easy Form Builder Plugin for WordPress

CVE-2025-14067

What is CVE-2025-14067?

The Easy Form Builder plugin for WordPress has a vulnerability that allows authenticated users with Subscriber-level access and higher to access sensitive data. This occurs due to a missing capability check in various AJAX actions, resulting from a logic flaw in the authorization checks. Instead of using the correct logic operator, the plugin uses AND (&&) where OR (||) is necessary, thereby inadvertently permitting unauthorized data retrieval. Attackers can exploit this flaw to gain access to sensitive form response data, including messages and user information.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References