[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fVVddvvvfCORj9yrlYHwhxPXBQQN0IM01irxMxQfa4h8":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":25,"research_verified":26,"research_rounds_completed":27,"research_plan":28,"research_summary":29,"research_vulnerable_code":9,"research_fix_diff":30,"research_exploit_outline":31,"research_model_used":32,"research_started_at":33,"research_completed_at":34,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":26,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":26,"source_links":35},"CVE-2025-11977","happyforms-authenticated-admin-local-file-inclusion","HappyForms \u003C= 1.26.12 - Authenticated (Admin+) Local File Inclusion","The Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.26.12 via the happyforms_get_form_partial() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.","happyforms",null,"\u003C=1.26.12","1.26.13","medium",6.6,"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:H\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H","Improper Control of Filename for Include\u002FRequire Statement in PHP Program ('PHP Remote File Inclusion')","2026-07-09 19:34:47","2026-07-10 07:48:44",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Fe31119ab-963d-48a4-9948-0a0dce761918?source=api-prod",1,[22,23,24],"happyforms.php","languages\u002Fhappyforms.pot","readme.txt","researched",false,3,"This research plan targets a Local File Inclusion (LFI) vulnerability in the Happyforms plugin (versions \u003C= 1.26.12). The vulnerability resides in the `happyforms_get_form_partial()` function, which fails to properly sanitize template paths before inclusion.\n\n### 1. Vulnerability Summary\n*   **Vulnerability:** Authenticated (Admin+) Local File Inclusion (LFI).\n*   **Vulnerable Function:** `happyforms_get_form_partial()` (likely located in `inc\u002Fclasses\u002Fclass-happyforms.php` or `core\u002Fhelpers\u002Fhelper-misc.php`).\n*   **Reason:** The function accepts a user-provided parameter (representing a template or partial name) and uses it directly in an `include` or `require` statement without sufficient sanitization or path validation. This allows an administrator to use directory traversal (`..\u002F`) to include arbitrary `.php` files.\n*   **Impact:** Execution of arbitrary PHP code (RCE) if an attacker can upload a `.php` file (e.g., via the media library) or inclusion of sensitive files that execute logic (like `wp-config.php`).\n\n### 2. Attack Vector Analysis\n*   **Endpoint:** `wp-admin\u002Fadmin-ajax.php` or a specific admin page (e.g., the Form Builder\u002FCustomizer).\n*   **Action:** Likely `happyforms_get_form_partial`.\n*   **Parameter:** Typically `template`, `part`, or `partial` (to be confirmed via grep).\n*   **Authentication:** Administrator-level access is required.\n*   **Preconditions:** The plugin must be active.\n\n### 3. Code Flow (Manual Discovery)\nThe researcher\u002Fagent must first locate the vulnerable sink:\n1.  **Search for the function:** \n    `grep -rn \"function happyforms_get_form_partial\" .`\n2.  **Trace the Sink:** Inside the function, look for `include`, `include_once`, `require`, or `require_once`. Identify the variable being passed.\n3.  **Find the Entry Point:** Search for where this function is called or registered as an AJAX action:\n    `grep -rn \"happyforms_get_form_partial\" .`\n    Look for `add_action( 'wp_ajax_...', ... )`.\n\n### 4. Nonce Acquisition Strategy\nHappyforms heavily utilizes the WordPress Customizer and AJAX. Admin nonces are typically localized for the dashboard.\n\n1.  **Identify the Script\u002FNonce:** Search for `wp_localize_script` in the codebase to find the handle.\n    `grep -rn \"wp_localize_script\" .`\n2.  **Likely Variable:** In Happyforms, nonces are often attached to `window.happyforms_admin` or `window.happyforms_customizer`.\n3.  **Acquisition Steps:**\n    *   Create a test form (if none exist) to ensure the builder scripts load: `wp eval \"HappyForms()->initialize_plugin();\"` (or use WP-CLI to create a form).\n    *   Navigate to the Happyforms admin page: `browser_navigate(\"http:\u002F\u002Flocalhost:8080\u002Fwp-admin\u002Fadmin.php?page=happyforms\")`.\n    *   Extract the nonce using `browser_eval`:\n        ```javascript\n        \u002F\u002F Hypothetical identifiers based on Happyforms naming conventions\n        window.happyforms_admin?.nonce || window.happyforms_settings?.nonce\n        ```\n\n### 5. Exploitation Strategy\n\n#### Step 1: Discover Parameters\nAssuming the function is an AJAX handler, use `http_request` to test parameters.\n*   **Action:** `happyforms_get_form_partial`\n*   **Target Parameter:** (Discovered in Step 3, e.g., `partial`)\n\n#### Step 2: Test Path Traversal\nAttempt to include a known WordPress file to confirm the LFI. We will target `wp-config` (which won't display source but will confirm execution\u002Finclusion if no error occurs vs a 404 for a non-existent file).\n\n**Request (Example):**\n```http\nPOST \u002Fwp-admin\u002Fadmin-ajax.php HTTP\u002F1.1\nContent-Type: application\u002Fx-www-form-urlencoded\n\naction=happyforms_get_form_partial&partial=..\u002F..\u002F..\u002F..\u002Fwp-config&nonce=[NONCE]\n```\n\n#### Step 3: RCE via Media Library (If applicable)\n1.  Upload a file named `poc.php` (containing `\u003C?php echo \"VULN_SUCCESS\"; ?>`) to the WordPress Media Library.\n2.  Identify the path (usually `wp-content\u002Fuploads\u002FYYYY\u002FMM\u002Fpoc.php`).\n3.  Include it via the LFI:\n    `partial=..\u002F..\u002F..\u002F..\u002Fwp-content\u002Fuploads\u002F2025\u002F01\u002Fpoc` (Note: The plugin likely appends `.php`).\n\n### 6. Test Data Setup\n1.  **Login as Admin:** Use the `login_as_admin` tool.\n2.  **Create a Form:** Ensure at least one Happyforms form exists to populate admin interfaces.\n    `wp post create --post_type=happyform --post_title=\"Exploit Test\" --post_status=publish`\n3.  **Locate Plugin Path:** Confirm plugin is at `wp-content\u002Fplugins\u002Fhappyforms\u002F`.\n\n### 7. Expected Results\n*   **Success:** The HTTP response body contains the output of the included PHP file (e.g., \"VULN_SUCCESS\") or a lack of \"File not found\" errors when targeting valid system files.\n*   **Evidence:** If including `wp-config.php`, the response may be empty (200 OK) because `wp-config.php` defines constants but produces no output. Including a non-existent file should trigger a PHP warning\u002Ferror if `WP_DEBUG` is on, or a plugin-specific error message.\n\n### 8. Verification Steps\n1.  **Error Log Check:** Check `wp-content\u002Fdebug.log` for \"failed to open stream\" errors which indicate the inclusion path attempted:\n    `tail -n 20 \u002Fvar\u002Fwww\u002Fhtml\u002Fwp-content\u002Fdebug.log`\n2.  **PHP Execution:** If a shell was uploaded, verify the existence of a file created by the shell.\n\n### 9. Alternative Approaches\n*   **Wrapper Inclusion:** If direct inclusion is blocked by `.php` extension enforcement, try `php:\u002F\u002Ffilter\u002Fconvert.base64-encode\u002Fresource=wp-config` to read the configuration.\n    *   *Note:* If the plugin appends `.php`, the payload would be `php:\u002F\u002Ffilter\u002Fconvert.base64-encode\u002Fresource=..\u002F..\u002F..\u002F..\u002Fwp-config` (the filter will look for `wp-config.php`).\n*   **Template Directives:** Check if the vulnerability is accessible via the `[happyforms]` shortcode processing if it dynamically loads parts based on attributes.","The Happyforms plugin for WordPress is vulnerable to Local File Inclusion (LFI) in versions up to and including 1.26.12 through the happyforms_get_form_partial() function. This allows authenticated administrators to include and execute arbitrary PHP files on the server by exploiting insufficient sanitization of template paths containing directory traversal sequences.","diff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fhappyforms\u002F1.26.12\u002Fhappyforms.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fhappyforms\u002F1.26.13\u002Fhappyforms.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fhappyforms\u002F1.26.12\u002Fhappyforms.php\t2025-11-18 19:13:52.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fhappyforms\u002F1.26.13\u002Fhappyforms.php\t2026-03-30 19:53:50.000000000 +0000\n@@ -5,7 +5,7 @@\n  * Plugin URI:  https:\u002F\u002Fhappyforms.io\n  * Description: Form builder to get in touch with visitors, grow your email list and collect payments.\n  * Author:      Happyforms\n- * Version:     1.26.12\n+ * Version:     1.26.13\n  * Author URI:  https:\u002F\u002Fhappyforms.io\n  * Upgrade URI: https:\u002F\u002Fhappyforms.io\u002Fupgrade\n  *\u002F\n@@ -22,7 +22,7 @@\n \u002F**\n  * The current version of the plugin.\n  *\u002F\n-define( 'HAPPYFORMS_VERSION', '1.26.12' );\n+define( 'HAPPYFORMS_VERSION', '1.26.13' );\n \n if ( ! function_exists( 'happyforms_get_version' ) ):\n \n@@ -143,7 +143,7 @@\n \u002F**\n  * Start general admin and frontend hooks.\n  *\u002F\n-add_action( 'plugins_loaded', array( HappyForms(), 'initialize_plugin' ) );\n+add_action( 'init', array( HappyForms(), 'initialize_plugin' ), 0 );\n \n \u002F**\n  * Start Customize screen specific hooks.\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fhappyforms\u002F1.26.12\u002Freadme.txt\t2025-11-18 19:13:52.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fhappyforms\u002F1.26.13\u002Freadme.txt\t2026-03-30 19:53:50.000000000 +0000\n@@ -3,9 +3,9 @@\n Contributors: happyforms\n Tags: contact form, WordPress form plugin, forms, form builder, custom form\n Requires at least: 5.0\n-Tested up to: 6.8.3\n+Tested up to: 6.9.4\n Requires PHP: 7.0\n-Stable tag: 1.26.12\n+Stable tag: 1.26.13\n License: GPLv2 or later\n License URI: http:\u002F\u002Fwww.gnu.org\u002Flicenses\u002Fgpl-2.0.html\n \n@@ -289,6 +289,13 @@\n \n == Changelog ==\n \n+= March 30, 2026 =\n+\n+Version 1.26.13 changelog:\n+\n+* Update: Compatibility with WordPress 6.9.4.\n+* Fixed: Translation loading notice triggered on WordPress 6+.\n+\n = November 18, 2025 =\n \n Version 1.26.12 changelog:\n@@ -649,6 +656,11 @@\n \n == Upgrade Notice ==\n \n+= 1.26.13 =\n+\n+* Update: Compatibility with WordPress 6.9.4.\n+* Fixed: Translation loading notice triggered on WordPress 6+.\n+\n = 1.26.12 =","1. Authenticate as a user with Administrator-level access to the WordPress site.\n2. Obtain a valid security nonce from the Happyforms admin dashboard, typically localized in the builder or customizer scripts (e.g., from `window.happyforms_admin.nonce`).\n3. Trigger an AJAX request (POST) to `wp-admin\u002Fadmin-ajax.php` with the `action` parameter set to `happyforms_get_form_partial`.\n4. Provide a parameter (likely `partial` or `template`) containing a directory traversal payload like `..\u002F..\u002F..\u002F..\u002Fwp-config` (targeting `wp-config.php` assuming the plugin appends the extension) or a path to a malicious PHP file previously uploaded to the Media Library.\n5. Upon processing, the plugin will use the provided path in an `include` or `require` statement, executing the targeted PHP file in the context of the WordPress environment.","gemini-3-flash-preview","2026-07-15 10:30:12","2026-07-15 10:31:21",{"type":36,"vulnerable_version":37,"fixed_version":11,"vulnerable_browse":38,"vulnerable_zip":39,"fixed_browse":40,"fixed_zip":41,"all_tags":42},"plugin","1.26.12","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fhappyforms\u002Ftags\u002F1.26.12","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fhappyforms.1.26.12.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fhappyforms\u002Ftags\u002F1.26.13","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fhappyforms.1.26.13.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fhappyforms\u002Ftags"]