Code Injection Vulnerability in WPForms Google Sheet Connector by WesternDeal
CVE-2025-67979

9.9CRITICAL

Key Information:

Vendor

WordPress
Status
WPforms Google Sheet Connector
Vendor
CVE Published:
20 February 2026

What is CVE-2025-67979?

A code injection vulnerability exists in the WPForms Google Sheet Connector, specifically in versions up to 4.0.1. This flaw permits attackers to manipulate code execution, posing significant risks to user data and system stability. The improper control of code generation in this plugin can be exploited, leading to remote code execution and unauthorized actions within the application. It is crucial for users to update to the latest version to mitigate these security risks.

Affected Version(s)

WPForms Google Sheet Connector 0 <= 4.0.1

References

https://patchstack.com/database/Wordpress/Plugin/gsheetco...
vdb-entry

CVSS V3.1

Score:
9.9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Denver Jackson | Patchstack Bug Bounty Program
.