CVE-2025-5392
Published: 11 July 2025
Summary
CVE-2025-5392 is a critical-severity Code Injection (CWE-94) vulnerability in Wordpress (inferred from references). Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 18.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
The GB Forms DB plugin for WordPress is vulnerable to remote code execution in all versions up to and including 1.0.2. The flaw exists in the gbfdb_talk_to_front() function, which accepts unsanitized user input and passes it directly to call_user_func(), resulting in arbitrary code execution classified as CWE-94.
Unauthenticated attackers can exploit the issue over the network without any user interaction or privileges. Successful attacks can execute code on the server, enabling actions such as backdoor injection or creation of new administrative accounts, consistent with the CVSS 9.8 rating indicating full impact on confidentiality, integrity, and availability.
Advisories reference the vulnerable code paths in the plugin's core/functions.php file along with a WordPress Trac changeset that updates the affected component, indicating that applying the patch resolves the exposure. The associated EPSS score remains flat at a low value of 0.0155 with no material increase observed.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-21121
Vulnerability details
The GB Forms DB plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0.2 via the gbfdb_talk_to_front() function. This is due to the function accepting user input and then passing that through call_user_func().…
more
This makes it possible for unauthenticated attackers to execute code on the server which can be leverage to inject backdoors or create new administrative user accounts to name a few things.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct unauthenticated RCE via unsanitized input to call_user_func() in public-facing WordPress plugin enables T1190 (Exploit Public-Facing Application).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely identification, reporting, and correction of the RCE flaw in the GB Forms DB plugin via updates beyond version 1.0.2.
Mandates validation of unsanitized user inputs before passing to call_user_func() in gbfdb_talk_to_front(), directly preventing arbitrary code execution.
Deploys malicious code protection at system entry points to block or identify exploit attempts leveraging the vulnerable plugin function.