PT-2025-29211 · WordPress · Gb Forms Db

Alexander Chikaylo · Published 2025-07-11 · Updated 2025-07-11 · CVE-2025-5392

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: GB Forms DB plugin for WordPress versions up to and including 1.0.2

Description: The GB Forms DB plugin for WordPress is susceptible to Remote Code Execution via the gbfdb talk to front() function. The function accepts user input and passes it through call user func(), allowing unauthenticated attackers to execute code on the server. This could enable attackers to inject backdoors or create new administrative user accounts.

Recommendations: Update the GB Forms DB plugin to a version beyond 1.0.2.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2025-5392

Affected Products

Gb Forms Db

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-5392 · Security Note
• https://twitter.com/VulmonFeeds/status/1943609932793696336 · Twitter Post
• https://t.me/cvetracker/27538 · Telegram Post
• https://plugins.trac.wordpress.org/browser/gb-forms-db/trunk/core/functions.php#L334 · Note
• https://t.me/cvenotify/128499 · Telegram Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3323703%40gb-forms-db&new=3323703%40gb-forms-db&sfp_email=&sfph_mail= · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/fe8723a7-bbb1-41a0-b222-3cf4eb44cd64?source=cve · Note
• https://twitter.com/CVEnew/status/1943668135045009634 · Twitter Post
• https://plugins.trac.wordpress.org/browser/gb-forms-db/trunk/core/functions.php#L367 · Note