CVE-2025-2801: Create custom forms for WordPress with a smart form plugin for smart businesses <= 1.2.4 - Unauthenticated Arbitrary Shortcode Execution
First published: Sat Apr 26 2025(Updated: )
The The Create custom forms for WordPress with a smart form plugin for smart businesses plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.2.4. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| WordPress Smart Forms | <=1.2.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.wordfence.com/threat-intel/vulnerabilities/id/e45afda4-447a-4d95-90cb-9731b398a009?source=cve
- https://plugins.trac.wordpress.org/browser/abcsubmit/tags/1.2.4/abcsubmit.php#L86
- https://plugins.trac.wordpress.org/browser/abcsubmit/tags/1.2.4/abcsubmit.php#L88
- https://wordpress.org/plugins/abcsubmit/#developers
Frequently Asked Questions
What is the severity of CVE-2025-2801?
CVE-2025-2801 is classified as a critical vulnerability due to its ability to allow arbitrary shortcode execution in affected versions.
How do I fix CVE-2025-2801?
To fix CVE-2025-2801, update the 'Create custom forms for WordPress with a smart form plugin for smart businesses' plugin to version 1.2.5 or later.
Who is affected by CVE-2025-2801?
All users of the 'Create custom forms for WordPress with a smart form plugin for smart businesses' plugin versions up to and including 1.2.4 are affected by CVE-2025-2801.
What type of attack does CVE-2025-2801 enable?
CVE-2025-2801 enables attackers to execute arbitrary shortcodes on affected WordPress sites, potentially leading to unwanted actions or exposure of sensitive data.
Is there any workaround for CVE-2025-2801?
There are no known workarounds for CVE-2025-2801; the recommended action is to update to the latest version of the plugin.
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/references
- agent/title
- agent/type
- agent/first-publish-date
- agent/description
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/author
- agent/source
- agent/severity
- agent/last-modified-date
- agent/tags
- agent/event
- vendor/wordpress
- canonical/wordpress smart forms