PT-2025-28843 · WordPress · Sureforms

Phat Rio · Published 2025-07-09 · Updated 2025-07-14 · CVE-2025-6691

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions: SureForms – Drag and Drop Form Builder for WordPress plugin versions through 1.7.3

Description: The SureForms – Drag and Drop Form Builder for WordPress plugin is susceptible to arbitrary file deletion due to inadequate file path validation within the delete entry files() function. This allows unauthenticated attackers to delete arbitrary files on the server, potentially leading to remote code execution if critical files, such as wp-config.php, are removed. Approximately 200,000 sites are potentially affected.

Recommendations: Update SureForms – Drag and Drop Form Builder for WordPress plugin to a version later than 1.7.3.

Fix

RCE

Weakness Enumeration

CWE-610

CWE-73

Related Identifiers

CVE-2025-6691

Affected Products

Sureforms

References · 16

• https://osv.dev/vulnerability/CVE-2025-6691 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-6691 · Security Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3319753%40sureforms&new=3319753%40sureforms&sfp_email=&sfph_mail= · Patch
• https://twitter.com/the_yellow_fall/status/1943222327963193654 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/b4658546-bf57-414b-a3c9-bf7a5692c5fe?source=cve · Note
• https://wordpress.org/plugins/sureforms · Note
• https://t.me/pentestingnews/64247 · Telegram Post
• https://t.me/cvenotify/128144 · Telegram Post
• https://twitter.com/CVEnew/status/1942924466620973465 · Twitter Post
• https://plugins.trac.wordpress.org/browser/sureforms/trunk/admin/views/entries-list-table.php#L661 · Note
• https://twitter.com/dailytechonx/status/1943769766029848713 · Twitter Post
• https://twitter.com/dailycve/status/1944085650791080428 · Twitter Post
• https://t.me/cvenotify/128657 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1942929029020914027 · Twitter Post
• https://twitter.com/fridaysecurity/status/1943222056549581248 · Twitter Post