{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-47527", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2025-05-07T09:39:46.951Z", "datePublished": "2025-06-09T15:54:09.986Z", "dateUpdated": "2025-06-09T17:23:06.702Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2025-06-09T15:54:09.986Z"}, "title": "WordPress Icegram Collect \u2013 Easy Form, Lead Collection and Subscription plugin <= 1.3.18 - Broken Access Control Vulnerability", "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "CWE-862 Missing Authorization", "lang": "en", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels"}]}], "affected": [{"vendor": "Icegram", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "icegram-rainmaker", "product": "Icegram Collect \u2013 Easy Form, Lead Collection and Subscription plugin", "versions": [{"lessThanOrEqual": "1.3.18", "status": "affected", "version": "n/a", "versionType": "custom", "changes": [{"at": "1.3.19", "status": "unaffected"}]}]}], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in Icegram Icegram Collect \u2013 Easy Form, Lead Collection and Subscription plugin allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Icegram Collect \u2013 Easy Form, Lead Collection and Subscription plugin: from n/a through 1.3.18.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Missing Authorization vulnerability in Icegram Icegram Collect \u2013 Easy Form, Lead Collection and Subscription plugin allows Exploiting Incorrectly Configured Access Control Security Levels.</p><p>This issue affects Icegram Collect \u2013 Easy Form, Lead Collection and Subscription plugin: from n/a through 1.3.18.</p>"}]}], "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/wordpress/plugin/icegram-rainmaker/vulnerability/wordpress-icegram-collect-easy-form-lead-collection-and-subscription-plugin-1-3-18-broken-access-control-vulnerability?_s_id=cve"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"baseScore": 7.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H", "baseSeverity": "HIGH", "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "version": "3.1"}}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Update the WordPress Icegram Collect \u2013 Easy Form, Lead Collection and Subscription plugin plugin to the latest available version (at least 1.3.19)."}], "value": "Update the WordPress Icegram Collect \u2013 Easy Form, Lead Collection and Subscription plugin plugin to the latest available version (at least 1.3.19)."}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "ch4r0n (Patchstack Alliance)"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-06-09T17:16:37.606905Z", "id": "CVE-2025-47527", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-09T17:23:06.702Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-47527", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-06-09T17:16:37.606905Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-09T17:16:36.473Z"}}], "cna": {"title": "WordPress Icegram Collect \u2013 Easy Form, Lead Collection and Subscription plugin <= 1.3.18 - Broken Access Control Vulnerability", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "ch4r0n (Patchstack Alliance)"}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Icegram", "product": "Icegram Collect \u2013 Easy Form, Lead Collection and Subscription plugin", "versions": [{"status": "affected", "changes": [{"at": "1.3.19", "status": "unaffected"}], "version": "n/a", "versionType": "custom", "lessThanOrEqual": "1.3.18"}], "packageName": "icegram-rainmaker", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Update the WordPress Icegram Collect \u2013 Easy Form, Lead Collection and Subscription plugin plugin to the latest available version (at least 1.3.19).", "supportingMedia": [{"type": "text/html", "value": "Update the WordPress Icegram Collect \u2013 Easy Form, Lead Collection and Subscription plugin plugin to the latest available version (at least 1.3.19).", "base64": false}]}], "references": [{"url": "https://patchstack.com/database/wordpress/plugin/icegram-rainmaker/vulnerability/wordpress-icegram-collect-easy-form-lead-collection-and-subscription-plugin-1-3-18-broken-access-control-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in Icegram Icegram Collect \u2013 Easy Form, Lead Collection and Subscription plugin allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Icegram Collect \u2013 Easy Form, Lead Collection and Subscription plugin: from n/a through 1.3.18.", "supportingMedia": [{"type": "text/html", "value": "<p>Missing Authorization vulnerability in Icegram Icegram Collect \u2013 Easy Form, Lead Collection and Subscription plugin allows Exploiting Incorrectly Configured Access Control Security Levels.</p><p>This issue affects Icegram Collect \u2013 Easy Form, Lead Collection and Subscription plugin: from n/a through 1.3.18.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2025-06-09T15:54:09.986Z"}}}, "cveMetadata": {"cveId": "CVE-2025-47527", "state": "PUBLISHED", "dateUpdated": "2025-06-09T17:23:06.702Z", "dateReserved": "2025-05-07T09:39:46.951Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2025-06-09T15:54:09.986Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in Icegram Icegram Collect \u2013 Easy Form, Lead Collection and Subscription plugin allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Icegram Collect \u2013 Easy Form, Lead Collection and Subscription plugin: from n/a through 1.3.18."}, {"lang": "es", "value": "La vulnerabilidad de falta de autorizaci\u00f3n en Icegram Icegram Collect \u2013 Easy Form, Lead Collection and Subscription permite explotar niveles de seguridad de control de acceso configurados incorrectamente. Este problema afecta al plugin Icegram Collect (Formulario F\u00e1cil, Recopilaci\u00f3n de Clientes Potenciales y Suscripci\u00f3n) desde n/d hasta la versi\u00f3n 1.3.18."}], "id": "CVE-2025-47527", "lastModified": "2025-06-12T16:06:47.857", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.2, "source": "audit@patchstack.com", "type": "Secondary"}]}, "published": "2025-06-09T16:15:41.550", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/wordpress/plugin/icegram-rainmaker/vulnerability/wordpress-icegram-collect-easy-form-lead-collection-and-subscription-plugin-1-3-18-broken-access-control-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "audit@patchstack.com", "type": "Primary"}]}

{}