{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-47527",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-06-09T17:16:37.606905Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-09T17:23:06.702Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "icegram-rainmaker",
          "product": "Icegram Collect",
          "vendor": "Icegram",
          "versions": [
            {
              "changes": [
                {
                  "at": "1.3.19",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "1.3.18",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "ch4r0n | Patchstack Bug Bounty Program"
        }
      ],
      "datePublic": "2026-04-01T16:40:05.958Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Missing Authorization vulnerability in Icegram Icegram Collect icegram-rainmaker allows Exploiting Incorrectly Configured Access Control Security Levels.\u003cp\u003eThis issue affects Icegram Collect: from n/a through \u003c= 1.3.18.\u003c/p\u003e"
            }
          ],
          "value": "Missing Authorization vulnerability in Icegram Icegram Collect icegram-rainmaker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Icegram Collect: from n/a through \u003c= 1.3.18."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-180",
          "descriptions": [
            {
              "lang": "en",
              "value": "Exploiting Incorrectly Configured Access Control Security Levels"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-01T15:53:28.723Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/Wordpress/Plugin/icegram-rainmaker/vulnerability/wordpress-icegram-collect-easy-form-lead-collection-and-subscription-plugin-1-3-18-broken-access-control-vulnerability?_s_id=cve"
        }
      ],
      "title": "WordPress Icegram Collect \u2013 Easy Form, Lead Collection and Subscription plugin \u003c= 1.3.18 - Broken Access Control Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2025-47527",
    "datePublished": "2025-06-09T15:54:09.986Z",
    "dateReserved": "2025-05-07T09:39:46.951Z",
    "dateUpdated": "2026-04-01T15:53:28.723Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-47527\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-06-09T17:16:37.606905Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-06-09T17:16:36.473Z\"}}], \"cna\": {\"title\": \"WordPress Icegram Collect \\u2013 Easy Form, Lead Collection and Subscription plugin \u003c= 1.3.18 - Broken Access Control Vulnerability\", \"source\": {\"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"user\": \"00000000-0000-4000-9000-000000000000\", \"value\": \"ch4r0n (Patchstack Alliance)\"}], \"impacts\": [{\"capecId\": \"CAPEC-180\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.1, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Icegram\", \"product\": \"Icegram Collect \\u2013 Easy Form, Lead Collection and Subscription plugin\", \"versions\": [{\"status\": \"affected\", \"changes\": [{\"at\": \"1.3.19\", \"status\": \"unaffected\"}], \"version\": \"n/a\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"1.3.18\"}], \"packageName\": \"icegram-rainmaker\", \"collectionURL\": \"https://wordpress.org/plugins\", \"defaultStatus\": \"unaffected\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"Update the WordPress Icegram Collect \\u2013 Easy Form, Lead Collection and Subscription plugin plugin to the latest available version (at least 1.3.19).\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Update the WordPress Icegram Collect \\u2013 Easy Form, Lead Collection and Subscription plugin plugin to the latest available version (at least 1.3.19).\", \"base64\": false}]}], \"references\": [{\"url\": \"https://patchstack.com/database/wordpress/plugin/icegram-rainmaker/vulnerability/wordpress-icegram-collect-easy-form-lead-collection-and-subscription-plugin-1-3-18-broken-access-control-vulnerability?_s_id=cve\", \"tags\": [\"vdb-entry\"]}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Missing Authorization vulnerability in Icegram Icegram Collect \\u2013 Easy Form, Lead Collection and Subscription plugin allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Icegram Collect \\u2013 Easy Form, Lead Collection and Subscription plugin: from n/a through 1.3.18.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eMissing Authorization vulnerability in Icegram Icegram Collect \\u2013 Easy Form, Lead Collection and Subscription plugin allows Exploiting Incorrectly Configured Access Control Security Levels.\u003c/p\u003e\u003cp\u003eThis issue affects Icegram Collect \\u2013 Easy Form, Lead Collection and Subscription plugin: from n/a through 1.3.18.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-862\", \"description\": \"CWE-862 Missing Authorization\"}]}], \"providerMetadata\": {\"orgId\": \"21595511-bba5-4825-b968-b78d1f9984a3\", \"shortName\": \"Patchstack\", \"dateUpdated\": \"2025-06-09T15:54:09.986Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-47527\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-06-09T17:23:06.702Z\", \"dateReserved\": \"2025-05-07T09:39:46.951Z\", \"assignerOrgId\": \"21595511-bba5-4825-b968-b78d1f9984a3\", \"datePublished\": \"2025-06-09T15:54:09.986Z\", \"assignerShortName\": \"Patchstack\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}