CVE-2025-6691

Summary

The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_entry_files() function in all versions up to, and including, 1.7.3. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).

Affected Software

VendorProductVersion RangeStatus
brainstormforceSureForms – Drag and Drop Form Builder for WordPress0.0 <= 0.0.13affected
brainstormforceSureForms – Drag and Drop Form Builder for WordPress1.0 <= 1.0.6affected
brainstormforceSureForms – Drag and Drop Form Builder for WordPress1.1 <= 1.1.1affected
brainstormforceSureForms – Drag and Drop Form Builder for WordPress1.2 <= 1.2.4affected
brainstormforceSureForms – Drag and Drop Form Builder for WordPress1.3 <= 1.3.1affected
brainstormforceSureForms – Drag and Drop Form Builder for WordPress1.4 <= 1.4.4affected
brainstormforceSureForms – Drag and Drop Form Builder for WordPress1.5affected
brainstormforceSureForms – Drag and Drop Form Builder for WordPress1.6 <= 1.6.4affected
brainstormforceSureForms – Drag and Drop Form Builder for WordPress1.7 <= 1.7.3affected

Weaknesses

  • CWE-73: CWE-73 External Control of File Name or Path

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References