« Volver al listado

CVE-2025-6742

Estado: AnalizadaAlta (7.5)—

The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.7.3 via the use of file_exists() in the delete_entry_files() function without restriction on the path provided. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

UI:R (interacción del usuario) en el vector CVSS indica explotación en el cliente (T1203). La inyección de objetos PHP con POP chain permite ejecución de código (T1059), manipulación de archivos (T1565.001) o acceso a datos (T1005) según la cadena disponible.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Restrict Web-Based ContentRestrict File and Directory PermissionsPrivileged Account ManagementRemote Data StorageLimit Software InstallationExecution Prevention

Tecnologías afectadas (1)

Brainstormforce — Sureforms

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-6742",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-6742",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-07-09T14:14:18.936885Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@wordfence.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.6
      }
    ]
  },
  "affected": [
    {
      "source": "security@wordfence.com",
      "affectedData": [
        {
          "vendor": "brainstormforce",
          "product": "SureForms – Drag and Drop Form Builder for WordPress",
          "versions": [
            {
              "status": "affected",
              "version": "0.0",
              "versionType": "semver",
              "lessThanOrEqual": "0.0.13"
            },
            {
              "status": "affected",
              "version": "1.0",
              "versionType": "semver",
              "lessThanOrEqual": "1.0.6"
            },
            {
              "status": "affected",
              "version": "1.1",
              "versionType": "semver",
              "lessThanOrEqual": "1.1.1"
            },
            {
              "status": "affected",
              "version": "1.2",
              "versionType": "semver",
              "lessThanOrEqual": "1.2.4"
            },
            {
              "status": "affected",
              "version": "1.3",
              "versionType": "semver",
              "lessThanOrEqual": "1.3.1"
            },
            {
              "status": "affected",
              "version": "1.4",
              "versionType": "semver",
              "lessThanOrEqual": "1.4.4"
            },
            {
              "status": "affected",
              "version": "1.5"
            },
            {
              "status": "affected",
              "version": "1.6",
              "versionType": "semver",
              "lessThanOrEqual": "1.6.4"
            },
            {
              "status": "affected",
              "version": "1.7",
              "versionType": "semver",
              "lessThanOrEqual": "1.7.3"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-07-09T06:15:25.220",
  "references": [
    {
      "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3319753%40sureforms&new=3319753%40sureforms&sfp_email=&sfph_mail=",
      "tags": [
        "Patch"
      ],
      "source": "security@wordfence.com"
    },
    {
      "url": "https://wordpress.org/plugins/sureforms/",
      "tags": [
        "Product"
      ],
      "source": "security@wordfence.com"
    },
    {
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1de12d1c-5ac4-4f80-b33d-a689a6916ee0?source=cve",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security@wordfence.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@wordfence.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-502"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.7.3 via the use of file_exists() in the delete_entry_files() function without restriction on the path provided. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present."
    },
    {
      "lang": "es",
      "value": "El complemento SureForms – Drag and Drop Form Builder for WordPress para WordPress es vulnerable a la inyección de objetos PHP en todas las versiones hasta la 1.7.3 incluida, mediante el uso de file_exists() en la función delete_entry_files() sin restricción en la ruta proporcionada. Esto permite a atacantes no autenticados inyectar un objeto PHP. No se conoce ninguna cadena POP presente en el software vulnerable, lo que significa que esta vulnerabilidad no tiene impacto a menos que se instale en el sitio otro complemento o tema que contenga una cadena POP. Si una cadena POP está presente a través de un complemento o tema adicional instalado en el sistema objetivo, puede permitir al atacante realizar acciones como eliminar archivos arbitrarios, recuperar datos confidenciales o ejecutar código, dependiendo de la cadena POP presente."
    }
  ],
  "lastModified": "2026-06-17T10:02:29.260",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:brainstormforce:sureforms:*:*:*:*:*:wordpress:*:*",
              "vulnerable": true,
              "matchCriteriaId": "25076177-F17B-42E9-B379-5BFA9C9998BC",
              "versionEndExcluding": "0.0.14",
              "versionStartIncluding": "0.0.2"
            },
            {
              "criteria": "cpe:2.3:a:brainstormforce:sureforms:*:*:*:*:*:wordpress:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BDE67AEC-C7D4-4932-8E50-7FAB1083ECC1",
              "versionEndExcluding": "1.0.7",
              "versionStartIncluding": "1.0.0"
            },
            {
              "criteria": "cpe:2.3:a:brainstormforce:sureforms:*:*:*:*:*:wordpress:*:*",
              "vulnerable": true,
              "matchCriteriaId": "75474DE5-16CE-4D54-82D1-8641835CD4C3",
              "versionEndExcluding": "1.1.2",
              "versionStartIncluding": "1.1.0"
            },
            {
              "criteria": "cpe:2.3:a:brainstormforce:sureforms:*:*:*:*:*:wordpress:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F611D4A0-7AD9-4235-B768-1BC930EC1E61",
              "versionEndExcluding": "1.2.5",
              "versionStartIncluding": "1.2.0"
            },
            {
              "criteria": "cpe:2.3:a:brainstormforce:sureforms:*:*:*:*:*:wordpress:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E8D55A76-91F5-4331-B2EB-5CFBFFB76D35",
              "versionEndExcluding": "1.3.2",
              "versionStartIncluding": "1.3.0"
            },
            {
              "criteria": "cpe:2.3:a:brainstormforce:sureforms:*:*:*:*:*:wordpress:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BDC85CB7-7FF3-4216-96B9-28346C734EBB",
              "versionEndExcluding": "1.4.5",
              "versionStartIncluding": "1.4.0"
            },
            {
              "criteria": "cpe:2.3:a:brainstormforce:sureforms:*:*:*:*:*:wordpress:*:*",
              "vulnerable": true,
              "matchCriteriaId": "21F1E7ED-E4D7-48DF-BAF5-5766A3D150CD",
              "versionEndExcluding": "1.6.5",
              "versionStartIncluding": "1.6.0"
            },
            {
              "criteria": "cpe:2.3:a:brainstormforce:sureforms:*:*:*:*:*:wordpress:*:*",
              "vulnerable": true,
              "matchCriteriaId": "453C4BA2-3E81-4E6F-AACD-5FAFE560E637",
              "versionEndExcluding": "1.7.4",
              "versionStartIncluding": "1.7.0"
            },
            {
              "criteria": "cpe:2.3:a:brainstormforce:sureforms:1.5.0:*:*:*:*:wordpress:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F568EC16-784D-4551-9A6B-B6C77B5784C4"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@wordfence.com"
}