PT-2025-27851 · WordPress · Gozen Forms

Published 2025-07-04 · Updated 2025-07-20 · CVE-2025-6782

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: GoZen Forms plugin for WordPress versions prior to 1.1.5

Description: The issue allows for SQL Injection due to insufficient escaping on the forms-id parameter of the dirGZActiveForm() function and lack of sufficient preparation on the existing SQL query. This enables unauthenticated attackers to append additional SQL queries into already existing queries, potentially extracting sensitive information from the database.

Recommendations: For versions prior to 1.1.5, update to version 1.1.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the dirGZActiveForm() function until a patch is available. Avoid using the forms-id parameter in the affected function until the issue is resolved.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-6782

Affected Products

Gozen Forms

References · 8

• https://osv.dev/vulnerability/CVE-2025-6782 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-6782 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/d874a041-1cd4-4ca1-85bd-4050630d8502?source=cve · Note
• https://wordpress.org/plugins/gozen-forms · Note
• https://t.me/cvenotify/127690 · Telegram Post
• https://twitter.com/cracbot/status/1942901591121740052 · Twitter Post
• https://twitter.com/jmdevlabs/status/1946754288706818462 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1941001027110543765 · Twitter Post