The Happyforms – Form Builder for WordPress plugin contains a local file inclusion vulnerability (CWE‑98) in the happyforms_get_form_partial() function. When an authenticated user with administrator‑level or higher privileges supplies a path to an arbitrary .php file, the server includes and executes that file. This allows the attacker to run arbitrary PHP code, bypass access controls, read sensitive files or otherwise compromise the site.

Any WordPress installation that uses the Happyforms plugin version 1.26.12 or earlier, regardless of the WordPress core version.

The CVSS score of 6.6 denotes moderate severity, while the EPSS score of < 1% indicates a low likelihood of public exploitation at this time. The flaw requires administrator or higher privileges and the ability to place a malicious .php file on the server, limiting the attack surface to environments where such privileges exist. When both conditions are met, an attacker can execute code and potentially gain full server compromise. The vulnerability is not listed in CISA KEV, and no public exploits are known as of the current data.