CVE-2025-6691

HIGH 8.1

SureForms – Drag and Drop Form Builder for WordPress <= 1.7.3 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Submission Deletion

CVSS Score

8.1

EPSS Score

0.0%

EPSS Percentile

0th

The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_entry_files() function in all versions up to, and including, 1.7.3. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).

CWE	CWE-73
Vendor	brainstormforce
Product	sureforms – drag and drop form builder for wordpress
Published	Jul 9, 2025
Last Updated	Jul 9, 2025

Stay Ahead of the Next One

Get instant alerts for brainstormforce sureforms – drag and drop form builder for wordpress

Be the first to know when new high vulnerabilities affecting brainstormforce sureforms – drag and drop form builder for wordpress are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

brainstormforce / SureForms – Drag and Drop Form Builder for WordPress

0.0 ≤ 0.0.13 1.0 ≤ 1.0.6 1.1 ≤ 1.1.1 1.2 ≤ 1.2.4 1.3 ≤ 1.3.1 1.4 ≤ 1.4.4 1.5 1.6 ≤ 1.6.4 1.7 ≤ 1.7.3

References

NVD ↗ CVE.org ↗ EPSS Data ↗

wordfence.com: https://www.wordfence.com/threat-intel/vulnerabilities/id/b4658546-bf57-414b-a3c9-bf7a5692c5fe?source=cve wordpress.org: https://wordpress.org/plugins/sureforms/ plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/sureforms/trunk/admin/views/entries-list-table.php#L661 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3319753%40sureforms&new=3319753%40sureforms&sfp_email=&sfph_mail=

Credits

Nguyen Tan Phat