GB Forms DB <= 1.0.2 - Unauthenticated Remote Code Execution

The impact of CVE-2025-5392 is severe. Successful exploitation allows an attacker to execute arbitrary code on the WordPress server with the privileges of the web server user. This could lead to complete website takeover, data exfiltration, malware installation, and defacement. An attacker could inject malicious code to steal sensitive user data, including login credentials and personal information. Furthermore, they could create new administrative user accounts, granting them persistent access to the system. The lack of authentication required for exploitation significantly broadens the attack surface, making it accessible to a wide range of threat actors.

Websites utilizing the GB Forms DB plugin, particularly those running older, unpatched versions (1.0.0–1.0.2), are at significant risk. Shared hosting environments are particularly vulnerable as they often have limited control over plugin updates and security configurations. WordPress installations with default or weak security practices are also more susceptible to exploitation.

• wordpress / composer / npm:

grep -r 'gbfdb_talk_to_front(' /var/www/html/wp-content/plugins/gb-forms-db/

• generic web:

curl -I https://your-wordpress-site.com/wp-content/plugins/gb-forms-db/ | grep -i 'gbfdb_talk_to_front'

1. 2025-07-11Disclosure

   disclosure

1. Reserviert2025-05-30
2. Veröffentlicht2025-07-11
3. Geändert2026-04-08
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-5392 is to immediately upgrade the GB Forms DB plugin to version 1.0.3 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider temporarily disabling the GB Forms DB plugin. As a short-term workaround, implement strict input validation on the gbfdbtalkto_front() function to sanitize user-supplied data. Web Application Firewall (WAF) rules can be configured to block requests containing suspicious payloads targeting this function. Monitor WordPress logs for unusual activity or attempts to exploit the vulnerability. After upgrading, confirm the fix by attempting to trigger the vulnerable function with a malicious payload – it should now be properly sanitized.

Aktive Installationen

30

Plugin-Bewertung