CVE-2025-5392
GB Forms DB <= 1.0.2 - Unauthenticated Remote Code Execution
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
GB Forms DB <= 1.0.2 - Unauthenticated Remote Code Execution
The GB Forms DB plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0.2 via the gbfdb_talk_to_front() function. This is due to the function accepting user input and then passing that through call_user_func(). This makes it possible for unauthenticated attackers to execute code on the server which can be leverage to inject backdoors or create new administrative user accounts to name a few things.
Reserved 2025-05-30 | Published 2025-07-11 | Updated 2025-07-11 | Assigner WordfenceCWE-94 Improper Control of Generation of Code ('Code Injection')
| 2025-07-10: | Disclosed |
Alexander Chikaylo
www.wordfence.com/...-bbb1-41a0-b222-3cf4eb44cd64?source=cve
plugins.trac.wordpress.org/...ms-db/trunk/core/functions.php
plugins.trac.wordpress.org/...ms-db/trunk/core/functions.php
plugins.trac.wordpress.org/...forms-db&sfp_email=&sfph_mail=
Support options
