What the vulnerability does
01Description
The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.7.3 via the use of file_exists() in the delete_entry_files() function without restriction on the path provided. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
Explanation of Vulnerability in Simple Terms
02Summary
SureForms versions 0.0 through 0.0.13 contain a deserialization vulnerability that allows attackers to execute arbitrary code on WordPress sites. An attacker can craft a malicious serialized object that, when deserialized by the plugin, runs their own PHP code. The attack requires user interaction—typically a site admin or user must click a link or visit a page containing the malicious payload.
What an attacker can do
03Attacker Capabilities
Run arbitrary PHP code on the WordPress site and take full control of it.
Potential impact on your site
04Site Impact
Complete site compromise: attackers can steal data, modify content, create admin accounts, or inject malware into all pages.
Conditions required to exploit
05Prerequisites
Network access and user interaction required; no authentication needed. A victim must click a malicious link or visit an attacker-controlled page.
Key dates
06Disclosure timeline
July 9, 2025
CVE published
July 9, 2025
Record updated
