CVE-2025-14067 is a missing authorization vulnerability (CWE-862) in the Easy Form Builder plugin by WhiteStudio for WordPress. The issue is caused by a logic error in the authorization checks on multiple AJAX actions, where an AND (&&) operator is used instead of OR (||). This allows authenticated users with Subscriber-level privileges or above to bypass intended access controls and retrieve sensitive form data such as messages, admin replies, and user information. The vulnerability affects all versions up to and including 3.9.3. The CVSS 3.1 base score is 5.3, reflecting a medium severity impact primarily on confidentiality. There is no indication of known exploits in the wild or available patches.

Authenticated users with Subscriber-level access or higher can exploit this vulnerability to access sensitive form response data that should be restricted. This includes messages submitted through forms, administrative replies, and user information. The impact is limited to confidentiality loss; integrity and availability are not affected. Since the vulnerability requires at least Subscriber-level authentication, it does not allow unauthenticated remote exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted users only and consider disabling or limiting the use of the Easy Form Builder plugin if sensitive data exposure is a concern. Monitor for updates from the plugin vendor or WordPress security advisories to apply an official patch once available.