CVE-2025-68912

High

Published: 22 January 2026

Published

22 January 2026

Modified

27 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

EPSS Score 0.0052 39.9th percentile

Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2025-68912 is a high-severity Path Traversal (CWE-22) vulnerability. Its CVSS base score is 8.6 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 39.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-68912 is an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability, mapped to CWE-22, in the HDForms WordPress plugin from Harmonic Design. Published on 2026-01-22, it affects HDForms versions from n/a through 1.6.1, enabling attackers to traverse restricted directories.

The vulnerability carries a CVSS v3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H), indicating exploitation by unauthenticated remote attackers over the network with low attack complexity and no user interaction required. Attackers can achieve arbitrary file deletion, resulting in high availability impact by disrupting file-dependent services on affected WordPress installations.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/hdforms/vulnerability/wordpress-hdforms-plugin-1-6-1-arbitrary-file-deletion-vulnerability?_s_id=cve documents this as an arbitrary file deletion vulnerability in the HDForms plugin version 1.6.1, providing details for WordPress site administrators on identification and remediation.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-3965

Vulnerability details

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Harmonic Design HDForms hdforms allows Path Traversal.This issue affects HDForms: from n/a through <= 1.6.1.

CWE(s): CWE-22

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1485 Data Destruction Impact

Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources.

attack.mitre.org →

Why these techniques?

Path traversal in public-facing WordPress plugin enables unauthenticated remote exploitation (T1190) for arbitrary file deletion causing availability impact (T1485).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0