CVE-2025-5392: RCE in GB Forms DB WordPress Plugin

The impact of CVE-2025-5392 is severe. Successful exploitation allows an attacker to execute arbitrary code on the WordPress server with the privileges of the web server user. This could lead to complete website takeover, data exfiltration, malware installation, and defacement. An attacker could inject malicious code to steal sensitive user data, including login credentials and personal information. Furthermore, they could create new administrative user accounts, granting them persistent access to the system. The lack of authentication required for exploitation significantly broadens the attack surface, making it accessible to a wide range of threat actors.

1. Reserved2025-05-30
2. Published2025-07-11
3. Modified2026-04-08
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-5392 is to immediately upgrade the GB Forms DB plugin to version 1.0.3 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider temporarily disabling the GB Forms DB plugin. As a short-term workaround, implement strict input validation on the gbfdbtalkto_front() function to sanitize user-supplied data. Web Application Firewall (WAF) rules can be configured to block requests containing suspicious payloads targeting this function. Monitor WordPress logs for unusual activity or attempts to exploit the vulnerability. After upgrading, confirm the fix by attempting to trigger the vulnerable function with a malicious payload – it should now be properly sanitized.

Active installs

30

Plugin rating