CVE-2025-68912: Arbitrary File Access in HDForms

The Arbitrary File Access vulnerability in HDForms allows an attacker to bypass intended security restrictions and access files outside of the intended directory. By crafting malicious requests with carefully constructed file paths, an attacker can potentially retrieve configuration files, source code, or other sensitive data stored on the server. This could lead to the exposure of database credentials, API keys, or other confidential information. The blast radius extends to any data accessible by the web server process, potentially compromising the entire WordPress installation and any connected systems. While there's no direct precedent for this specific vulnerability, path traversal flaws are frequently exploited in web applications, often leading to significant data breaches.

1. Reserved2025-12-24
2. Published2026-01-22
3. Modified2026-04-28
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-68912 is to immediately upgrade HDForms to version 1.6.2 or later. If upgrading is not immediately feasible, implement temporary workarounds to reduce the risk. These include restricting file access permissions on the server to only allow the web server process to access necessary files. Implement strict input validation on all file paths to prevent path traversal attempts. Consider using a Web Application Firewall (WAF) with rules to block requests containing suspicious path characters (e.g., '..'). After upgrading, verify the fix by attempting to access a known sensitive file outside the intended directory via a web request; the request should be denied.

Active installs

50

Plugin rating