8.1

CVE-2025-6691

Medienbericht

SureForms – Drag and Drop Form Builder for WordPress <= 1.7.3 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Submission Deletion

SureForms – Drag and Drop Form Builder for WordPress <= 1.7.3 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Submission Deletion

The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_entry_files() function in all versions up to, and including, 1.7.3. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Mögliche Gegenmaßnahme
SureForms – Drag & Drop Contact Form & Form Builder, Payment Form, Survey, Quiz & Calculator: Update to one of the following versions, or a newer patched version: 0.0.14, 1.0.7, 1.1.2, 1.2.5, 1.3.2, 1.4.5, 1.5.1, 1.6.5, 1.7.4
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Brainstormforce ≫ Sureforms SwPlatformwordpress Version >= 0.0.2 < 0.0.14
Brainstormforce ≫ Sureforms SwPlatformwordpress Version >= 1.0.0 < 1.0.7
Brainstormforce ≫ Sureforms SwPlatformwordpress Version >= 1.1.0 < 1.1.2
Brainstormforce ≫ Sureforms SwPlatformwordpress Version >= 1.2.0 < 1.2.5
Brainstormforce ≫ Sureforms SwPlatformwordpress Version >= 1.3.0 < 1.3.2
Brainstormforce ≫ Sureforms SwPlatformwordpress Version >= 1.4.0 < 1.4.5
Brainstormforce ≫ Sureforms SwPlatformwordpress Version >= 1.6.0 < 1.6.5
Brainstormforce ≫ Sureforms SwPlatformwordpress Version >= 1.7.0 < 1.7.4
Brainstormforce ≫ Sureforms Version1.5.0 SwPlatformwordpress
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt SureForms – Drag & Drop Contact Form & Form Builder, Payment Form, Survey, Quiz & Calculator
Version 0.0-0.0.13
Version 1.0-1.0.6
Version 1.1-1.1.1
Version 1.2-1.2.4
Version 1.3-1.3.1
Version 1.4-1.4.4
Version 1.5
Version 1.6-1.6.4
Version 1.7-1.7.3
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.98% 0.577
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security@wordfence.com 8.1 2.8 5.2
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
CWE-610 Externally Controlled Reference to a Resource in Another Sphere

The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.

CWE-73 External Control of File Name or Path

The product allows user input to control or influence paths or file names that are used in filesystem operations.

Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
VulnDex Intel
Media Report
09.08.2025 11:36
https://www.wordfence.com/threat-intel/vulnerabilities/id/b4658546-bf57-414b-a3c9-bf7a5692c5fe?source=cve
Third Party Advisory
https://wordpress.org/plugins/sureforms/
Product
https://plugins.trac.wordpress.org/browser/sureforms/trunk/admin/views/entries-list-table.php#L661
Product
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3319753%40sureforms&new=3319753%40sureforms&sfp_email=&sfph_mail=
Patch
https://www.wordfence.com/threat-intel/vulnerabilities/id/b4658546-bf57-414b-a3c9-bf7a5692c5fe
Third Party Advisory