CVE-2025-11977 is a Local File Inclusion vulnerability (CWE-98) in the Happyforms – Form Builder for WordPress plugin affecting all versions up to and including 1.26.12. The vulnerability exists in the happyforms_get_form_partial() function, allowing authenticated attackers with Administrator privileges to include arbitrary PHP files on the server. Successful exploitation enables execution of arbitrary PHP code, potentially bypassing access controls and exposing sensitive data or enabling full code execution. The CVSS v3.1 base score is 6.6, reflecting a medium severity with network attack vector, high attack complexity, and requiring high privileges but no user interaction.

An attacker with Administrator-level access can exploit this vulnerability to execute arbitrary PHP code on the server by including malicious PHP files. This can lead to bypassing security controls, unauthorized data access, and full remote code execution on the affected system. The impact includes confidentiality, integrity, and availability violations as indicated by the CVSS vector (C:H/I:H/A:H).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Administrator-level access to trusted users only. Monitor for updates from the Happyforms vendor or WordPress plugin repository and apply patches promptly once released.