CVE-2025-6742
BaseFortify
Publication date: 2025-07-09
Last updated on: 2025-07-11
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| brainstormforce | sureforms | From 0.0.2 (inc) to 0.0.14 (exc) |
| brainstormforce | sureforms | From 1.0.0 (inc) to 1.0.7 (exc) |
| brainstormforce | sureforms | From 1.1.0 (inc) to 1.1.2 (exc) |
| brainstormforce | sureforms | From 1.2.0 (inc) to 1.2.5 (exc) |
| brainstormforce | sureforms | From 1.3.0 (inc) to 1.3.2 (exc) |
| brainstormforce | sureforms | From 1.4.0 (inc) to 1.4.5 (exc) |
| brainstormforce | sureforms | From 1.6.0 (inc) to 1.6.5 (exc) |
| brainstormforce | sureforms | From 1.7.0 (inc) to 1.7.4 (exc) |
| brainstormforce | sureforms | 1.5.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-502 | The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the SureForms – Drag and Drop Form Builder for WordPress plugin (up to version 1.7.3). It is a PHP Object Injection vulnerability caused by the use of the file_exists() function in the delete_entry_files() function without restricting the file path. This allows unauthenticated attackers to inject a PHP Object. However, the vulnerability only has an impact if another plugin or theme with a POP (Property Oriented Programming) chain is installed, which could then enable actions like deleting files, retrieving sensitive data, or executing code.
How can this vulnerability impact me? :
If the vulnerable plugin is installed along with another plugin or theme that contains a POP chain, an attacker could exploit this vulnerability to delete arbitrary files, retrieve sensitive data, or execute arbitrary code on the affected WordPress site. Without such a POP chain, the vulnerability has no impact.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, immediately update the SureForms – Drag and Drop Form Builder for WordPress plugin to a version later than 1.7.3 where the issue is fixed. Additionally, review and remove any other plugins or themes that may contain a POP chain, as the vulnerability requires a POP chain in another plugin or theme to be exploitable. Restrict file path inputs and monitor for unauthorized file deletions or modifications as precautionary measures.