PT-2026-8046 · WordPress · Easy Form Builder

Itthidej Aramsri · Published 2026-02-14 · Updated 2026-02-14 · CVE-2025-14067

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Easy Form Builder plugin for WordPress versions through 3.9.3

Description The Easy Form Builder plugin for WordPress has a flaw that allows unauthorized access to data. This is due to a missing capability check on multiple AJAX actions. Attackers with Subscriber-level access or higher can retrieve sensitive form response data, including messages, admin replies, and user information. The issue stems from a logic error in the authorization check, where the AND operator (&&) was used instead of the OR operator (||). The vulnerable AJAX actions allow retrieval of data without proper authorization.

Recommendations Update the Easy Form Builder plugin to a version later than 3.9.3.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-14067

Affected Products

Easy Form Builder

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-14067 · Security Note
• https://twitter.com/CVEarity/status/2022559349785170241 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/8fe397d3-68de-4358-8490-8fbafa1908ef?source=cve · Note
• https://plugins.trac.wordpress.org/changeset/3422020 · Note
• https://twitter.com/CVEnew/status/2022543947852067287 · Twitter Post
• https://plugins.trac.wordpress.org/browser/easy-form-builder/tags/3.9.0/includes/admin/class-Emsfb-admin.php#L709 · Note
• https://twitter.com/VulmonFeeds/status/2022614654963339671 · Twitter Post
• https://t.me/CVEtracker/44675 · Telegram Post
• https://plugins.trac.wordpress.org/browser/easy-form-builder/trunk/includes/admin/class-Emsfb-admin.php#L709 · Note