CVE-2025-67979: 
WordPress vulnerability analysis and mitigation

CVE-2025-67979 is a Code Injection vulnerability (CWE-94) in the WesternDeal WPForms Google Sheet Connector WordPress plugin (gsheetconnector-wpforms), allowing low-privileged remote attackers to execute arbitrary code. All versions up to and including 4.0.1 are affected. The vulnerability was published on February 20, 2026, and carries a CVSS v3.1 base score of 9.9 (Critical) (Feedly).

The vulnerability is classified as CWE-94 (Improper Control of Generation of Code / Code Injection), meaning the plugin fails to properly sanitize or restrict user-supplied input before using it in a code generation or evaluation context. An attacker with low-level privileges (e.g., a subscriber or contributor account) can send a crafted network request without any user interaction to inject and execute arbitrary code. The changed scope (S:C) in the CVSS vector indicates that successful exploitation can impact resources beyond the vulnerable plugin itself, potentially affecting the entire WordPress installation and underlying server (Feedly).

Successful exploitation results in complete compromise of confidentiality, integrity, and availability of the affected system. An attacker can execute arbitrary code on the server, access sensitive data (including database credentials, API keys, and user data), modify or delete content, and potentially pivot to other systems on the same network. The changed scope means impact extends beyond the plugin to the broader WordPress environment and hosting infrastructure (Feedly).

As of the time of reporting, no public proof-of-concept exploit code has been identified, and there is no confirmed evidence of in-the-wild exploitation. The EPSS score is approximately 0.029% (0.000290), indicating a currently low probability of exploitation in the near term. No threat actor attribution has been made, and the vulnerability does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly).

1. Reconnaissance: Identify WordPress sites running the WPForms Google Sheet Connector plugin version ≤ 4.0.1 using tools like WPScan, Shodan, or by inspecting plugin directories on target sites.
2. Obtain low-privileged access: Register or obtain a low-privileged account (e.g., subscriber) on the target WordPress site, as the vulnerability requires only low privileges.
3. Identify the vulnerable endpoint: Locate the plugin's functionality that processes user-controlled input without proper sanitization — likely a settings or form-handling endpoint exposed by the plugin.
4. Craft a code injection payload: Construct a request containing a malicious payload (e.g., PHP code) designed to be evaluated server-side through the plugin's improper code generation logic.
5. Submit the payload: Send the crafted HTTP request to the vulnerable endpoint, triggering server-side code execution.
6. Achieve objectives: Leverage the code execution to establish a web shell, exfiltrate data, escalate privileges, or move laterally within the hosting environment (Feedly).

• Network: Unusual authenticated POST requests to WPForms Google Sheet Connector plugin endpoints from low-privileged user accounts; unexpected outbound connections from the web server to external IPs.
• File System: Newly created or modified PHP files in the WordPress uploads directory or plugin directories; presence of web shells (e.g., files containing eval(), base64_decode(), system(), or passthru() calls).
• Logs: WordPress access logs showing repeated or anomalous requests to plugin-specific endpoints (/wp-admin/admin-ajax.php or plugin REST routes) from authenticated low-privileged users; PHP error logs showing unexpected code evaluation errors.
• Process: Unusual child processes spawned by the web server process (e.g., apache2, nginx, php-fpm) such as bash, curl, wget, or python.

No patched version of the WPForms Google Sheet Connector plugin has been confirmed as available at the time of disclosure. Site administrators should immediately disable or uninstall the plugin if it is not critically required. Access to the plugin's functionality should be restricted to trusted administrators only. Implement a Web Application Firewall (WAF) to detect and block code injection attempts. Monitor for suspicious activity and apply the principle of least privilege to WordPress user accounts. Check the WordPress plugin repository or the vendor for an updated version exceeding 4.0.1 and apply it as soon as one becomes available (Feedly).

Wordfence referenced this vulnerability in their weekly WordPress vulnerability report for the period of February 2–8, 2026, highlighting it as part of a broader set of critical plugin vulnerabilities (Wordfence Blog). No significant additional vendor statements or notable researcher commentary have been identified beyond standard database entries.