CVE-2025-6691: SureForms – Drag and Drop Form Builder for WordPress <= 1.7.3 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Submission Deletion
The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteentryfiles() function in all versions up to, and including, 1.7.3. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/SureForms – Drag and Drop Form Builder for WordPressto a version that resolves this vulnerability.Fixed in 1.7.3
Event History
Frequently Asked Questions
What is the severity of CVE-2025-6691?
The severity of CVE-2025-6691 is critical due to its potential for arbitrary file deletion.
How do I fix CVE-2025-6691?
To fix CVE-2025-6691, update the SureForms Drag and Drop Form Builder to version 1.7.4 or later.
Who is affected by CVE-2025-6691?
CVE-2025-6691 affects all versions of the SureForms Drag and Drop Form Builder plugin up to and including 1.7.3.
Can CVE-2025-6691 be exploited by unauthenticated users?
Yes, CVE-2025-6691 can be exploited by unauthenticated users due to insufficient file path validation.
What function is responsible for the vulnerability in CVE-2025-6691?
The delete_entry_files() function is responsible for the vulnerability in CVE-2025-6691.