8.1

CVE-2025-6691

Medienbericht

SureForms – Drag and Drop Form Builder for WordPress <= 1.7.3 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Submission Deletion

The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_entry_files() function in all versions up to, and including, 1.7.3. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Mögliche Gegenmaßnahme
SureForms – Contact Form, Payment Form & Other Custom Form Builder: Update to one of the following versions, or a newer patched version: 0.0.14, 1.0.7, 1.1.2, 1.2.5, 1.3.2, 1.4.5, 1.5.1, 1.6.5, 1.7.4
Verknüpft mit AI von unstrukturierten Daten zu bestehenden CPE der NVD
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt SureForms – Contact Form, Payment Form & Other Custom Form Builder
Version 0.0-0.0.13
Version 1.0-1.0.6
Version 1.1-1.1.1
Version 1.2-1.2.4
Version 1.3-1.3.1
Version 1.4-1.4.4
Version 1.5
Version 1.6-1.6.4
Version 1.7-1.7.3
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Brainstormforce ≫ Sureforms SwPlatformwordpress Version >= 0.0.2 < 0.0.14
Brainstormforce ≫ Sureforms SwPlatformwordpress Version >= 1.0.0 < 1.0.7
Brainstormforce ≫ Sureforms SwPlatformwordpress Version >= 1.1.0 < 1.1.2
Brainstormforce ≫ Sureforms SwPlatformwordpress Version >= 1.2.0 < 1.2.5
Brainstormforce ≫ Sureforms SwPlatformwordpress Version >= 1.3.0 < 1.3.2
Brainstormforce ≫ Sureforms SwPlatformwordpress Version >= 1.4.0 < 1.4.5
Brainstormforce ≫ Sureforms SwPlatformwordpress Version >= 1.6.0 < 1.6.5
Brainstormforce ≫ Sureforms SwPlatformwordpress Version >= 1.7.0 < 1.7.4
Brainstormforce ≫ Sureforms Version1.5.0 SwPlatformwordpress
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.54% 0.669
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security@wordfence.com 8.1 2.8 5.2
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
CWE-610 Externally Controlled Reference to a Resource in Another Sphere

The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.

CWE-73 External Control of File Name or Path

The product allows user input to control or influence paths or file names that are used in filesystem operations.