# CVE-2025-11977: Happyforms WordPress plugin Local File Inclusion in happyforms_get_form_partial

Source: https://junglewise.ai/threats/cve-2025-11977-happyforms-wordpress-plugin-local-file-inclusion-in-happyforms  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-10. Updated: 2026-07-10  
License: CC BY 4.0 with a link back

CVE-2025-11977 · Severity: medium · CVSS 6.6 · Published 2026-07-10

Happyforms, a popular WordPress plugin used for creating contact forms and surveys, contains a security flaw that could allow an administrator to execute malicious code on the website's server. By exploiting this vulnerability, an attacker with high-level access could potentially take full control of the site, access sensitive data, or disrupt operations. This issue is particularly dangerous if the attacker is also able to upload files to the server.

Technologies: [Happyforms](https://junglewise.ai/threats/technologies/happyforms). Vendors: [Happyforms](https://junglewise.ai/threats/vendors/happyforms).

## Quick answers

**Is CVE-2025-11977 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-11977 being exploited in the wild.

**How severe is CVE-2025-11977?** Medium severity, with a CVSS score of 6.6, published 10 July 2026.

**Which products and versions are affected?** Happyforms <= 1.26.12.

**Is there a fix for CVE-2025-11977?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-11977 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-11977?** Check whether you run Happyforms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Happyforms plugin for WordPress is vulnerable to Local File Inclusion (LFI) in all versions up to and including 1.26.12. The vulnerability exists within the `happyforms_get_form_partial()` function, which fails to properly validate file paths before inclusion. An authenticated attacker with Administrator-level privileges can exploit this to include and execute arbitrary .php files already present on the server. If combined with a file upload vulnerability or a method to place malicious PHP files on the file system, this can lead to remote code execution (RCE). The attack requires network access and high privileges, and is mitigated by the complexity of needing a target file to include.

## Affected products

- happyforms Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms <= 1.26.12

## Timeline

- 2026-07-10: advisory: Advisory published by Wordfence/NVD

## References

- [https://plugins.svn.wordpress.org/happyforms/trunk/core/classes/class-wp-customize-form-manager.php](https://plugins.svn.wordpress.org/happyforms/trunk/core/classes/class-wp-customize-form-manager.php)
- [https://plugins.svn.wordpress.org/happyforms/trunk/core/helpers/helper-form-templates.php](https://plugins.svn.wordpress.org/happyforms/trunk/core/helpers/helper-form-templates.php)
- [https://plugins.trac.wordpress.org/changeset?reponame=&old=3494912%40happyforms&new=3494912%40happyforms](https://plugins.trac.wordpress.org/changeset?reponame=&old=3494912%40happyforms&new=3494912%40happyforms)
- [https://www.wordfence.com/threat-intel/vulnerabilities/id/e31119ab-963d-48a4-9948-0a0dce761918?source=cve](https://www.wordfence.com/threat-intel/vulnerabilities/id/e31119ab-963d-48a4-9948-0a0dce761918?source=cve)

## Related threats

- [Happyforms plugin stored XSS via spoofable client IP headers](https://junglewise.ai/threats/cve-2026-93755-the-happyforms-plugin-for-wordpress-is-vulnerable-to-stored-cross)
- [HappyForms WordPress plugin HTML injection in notification email](https://junglewise.ai/threats/cve-2026-14556-the-happyforms-wordpress-plugin-before-1-26-15-does-not-sanitise)
- [WordPress Happyforms plugin unauthenticated cross-site scripting](https://junglewise.ai/threats/cve-2026-97065-unauthenticated-cross-site-scripting-xss-in-happyforms-1-26-15)
- [Happyforms PHP Object Injection in WordPress plugin](https://junglewise.ai/threats/cve-2026-49768-happyforms-php-object-injection-in-wordpress-plugin)