The vulnerability, assigned CVE-2025-6691 with a CVSS score of 8.8, allows unauthenticated attackers to delete arbitrary files on affected servers, including the crucial wp-config.php file that controls WordPress database connections. The SureForms plugin, a popular drag-and-drop form builder for WordPress, contains a fundamental flaw in its file handling mechanism that enables malicious actors to exploit form submissions without requiring any authentication. Brainstorm Force released patches on June 30, 2025, implementing proper path validation through the delete_upload_file_from_subdir() function to restrict file operations to the sureforms subdirectory. A critical security vulnerability has been discovered in the SureForms WordPress plugin, affecting over 200,000 websites worldwide and potentially exposing them to complete site takeover attacks. When attackers successfully delete the wp-config.php file, they can force the WordPress site into setup mode, allowing them to establish their own database connection and effectively take control of the entire website. The technical root of this vulnerability lies in the plugin’s inadequate validation of file paths during form submission processing. The vulnerability stems from insufficient checks in the prepare_submission_data() function, which fails to validate user-supplied file paths properly. Attackers can manipulate form submissions to include arbitrary file paths, even in forms without file upload fields. When administrators delete these submissions, the malicious file paths are processed, resulting in the deletion of critical system files. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. Wordfence analysts identified this vulnerability through their Bug Bounty Program, where security researcher Phat RiO from BlueRock discovered and responsibly reported the flaw on June 21, 2025. However, the function performs no field type validation, file extension checks, or upload directory restriction verification. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.
This Cyber News was published on cybersecuritynews.com. Publication date: Fri, 11 Jul 2025 06:10:14 +0000