CVE-2025-11977 is a Local File Inclusion vulnerability (CWE-98) in the Happyforms – Form Builder for WordPress plugin, affecting all versions up to and including 1.26.12. The vulnerability exists in the happyforms_get_form_partial() function, which improperly controls the filename used in include/require statements. An attacker with Administrator-level access can exploit this to include arbitrary PHP files on the server, potentially executing malicious code or accessing sensitive data.

An attacker with Administrator privileges can exploit this vulnerability to execute arbitrary PHP code on the server by including crafted PHP files. This can lead to full compromise of the affected WordPress installation, including bypassing access controls and data disclosure. The CVSS 3.1 base score is 6.6 (medium severity), reflecting the requirement for high privileges and no user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Administrator-level access to trusted users only and monitor for suspicious activity related to file uploads and inclusion. Avoid uploading PHP files through the plugin or other means. Follow the vendor's updates for an official patch or workaround.