CVE-2025-8420

Description

The Request a Quote Form plugin for WordPress is vulnerable to Remote Code Execution in version less than, or equal to, 2.5.2 via the emd_form_builder_lite_pagenum function. This is due to the plugin not properly validating user input before using it as a function name. This makes it possible for unauthenticated attackers to execute code on the server, however, parameters can not be passed to the functions called.

Reserved 2025-07-31 | Published 2025-08-06 | Updated 2025-08-06 | Assigner Wordfence

Problem types

CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

Product status

Default status
unaffected

*
affected

Timeline

2025-07-31:	Vendor Notified
2025-08-05:	Disclosed

Credits

Michael Mazzolini finder

References

www.wordfence.com/...-aeac-49bc-960d-4b4ff83e9229?source=cve

plugins.trac.wordpress.org/...-a-quote&sfp_email=&sfph_mail=

cve.org (CVE-2025-8420)

nvd.nist.gov (CVE-2025-8420)

Download JSON