CVE-2025-67570: 
WordPress vulnerability analysis and mitigation

CVE-2025-67570 is a Missing Authorization vulnerability in the WPForms Google Sheet Connector WordPress plugin (by GSheetConnector/WesternDeal) that allows unauthenticated network-based attackers to exploit incorrectly configured access control security levels. All versions up to and including 4.0.0 are affected. The vulnerability was published on December 9, 2025, and assigned by Patchstack. It carries a CVSS v3.1 base score of 5.3 (Medium) (Feedly, EUVD).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify that a requesting user has the necessary permissions before performing sensitive operations. The attack vector is network-based, requires no authentication, no user interaction, and low attack complexity, making it trivially exploitable by any remote attacker. The flaw allows exploitation of incorrectly configured access control security levels, likely enabling unauthorized modification of plugin settings or data submitted to connected Google Sheets (Feedly).

Successful exploitation results in a low integrity impact with no confidentiality or availability impact, meaning an unauthenticated attacker can make unauthorized modifications to data or plugin functionality without gaining read access to sensitive information or disrupting service. In practice, this could allow an attacker to tamper with Google Sheets integration settings, manipulate form submission data routing, or interfere with connected spreadsheet data on affected WordPress sites (Feedly).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Feedly).

Users should update the WPForms Google Sheet Connector plugin to a version beyond 4.0.0 that includes the authorization fix. As an interim measure, site administrators can deactivate the plugin until a patched version is available, or restrict access to WordPress admin and plugin endpoints via firewall rules or IP allowlisting. Monitor the WordPress plugin repository and the vendor's release notes for a patched release (Feedly).