CVE-2025-68912
Published: 22 January 2026
Summary
CVE-2025-68912 is a high-severity Path Traversal (CWE-22) vulnerability. Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 21.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates CVE-2025-68912 by requiring timely patching of the HDForms plugin vulnerability enabling arbitrary file deletion.
Validates pathname inputs to the HDForms plugin to block path traversal attempts beyond restricted directories.
Boundary protection at web interfaces detects and blocks network-based path traversal exploits targeting the vulnerable HDForms plugin.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Path traversal in public-facing WordPress plugin enables unauthenticated remote exploitation (T1190) for arbitrary file deletion causing availability impact (T1485).
NVD Description
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Harmonic Design HDForms hdforms allows Path Traversal.This issue affects HDForms: from n/a through <= 1.6.1.
Deeper analysisAI
CVE-2025-68912 is an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability, mapped to CWE-22, in the HDForms WordPress plugin from Harmonic Design. Published on 2026-01-22, it affects HDForms versions from n/a through 1.6.1, enabling attackers to traverse restricted directories.
The vulnerability carries a CVSS v3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H), indicating exploitation by unauthenticated remote attackers over the network with low attack complexity and no user interaction required. Attackers can achieve arbitrary file deletion, resulting in high availability impact by disrupting file-dependent services on affected WordPress installations.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/hdforms/vulnerability/wordpress-hdforms-plugin-1-6-1-arbitrary-file-deletion-vulnerability?_s_id=cve documents this as an arbitrary file deletion vulnerability in the HDForms plugin version 1.6.1, providing details for WordPress site administrators on identification and remediation.
Details
- CWE(s)