EUVD-2025-21121CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionNVD
The GB Forms DB plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0.2 via the gbfdb_talk_to_front() function. This is due to the function accepting user input and then passing that through call_user_func(). This makes it possible for unauthenticated attackers to execute code on the server which can be leverage to inject backdoors or create new administrative user accounts to name a few things.
AnalysisAI
The GB Forms DB plugin for WordPress contains a critical unauthenticated Remote Code Execution vulnerability in the gbfdb_talk_to_front() function, affecting all versions up to 1.0.2. The vulnerability stems from unsanitized user input passed directly to call_user_func(), allowing attackers to execute arbitrary PHP code without authentication. This can be leveraged to inject backdoors, create administrative accounts, or achieve full server compromise.
Technical ContextAI
The vulnerability exists in the GB Forms DB WordPress plugin and represents a CWE-94 (Improper Control of Generation of Code) weakness. The gbfdb_talk_to_front() function accepts user-controlled input and passes it directly to PHP's call_user_func() without validation or sanitization. call_user_func() is a dangerous function when combined with untrusted input, as it can dynamically execute any callable function or method in the PHP environment. The attack vector is network-based with no authentication required, making this a pre-authentication code execution flaw. Affected systems are WordPress installations with the GB Forms DB plugin active.
RemediationAI
- IMMEDIATE: Deactivate and remove the GB Forms DB plugin if version 1.0.2 or earlier is installed.
- Check plugin repository or vendor website for patched versions beyond 1.0.2 and upgrade immediately when available.
- If a patch is not available, remove the plugin entirely until a secure version is released.
- Audit server logs (web server, WordPress audit logs if available) for exploitation attempts targeting AJAX endpoints or the gbfdb_talk_to_front function.
- Check for unauthorized administrative accounts or backdoor files created during the vulnerability window.
- Implement Web Application Firewall (WAF) rules to block requests to known vulnerable endpoints if the plugin cannot be immediately removed.
- Monitor WordPress security advisories and the plugin vendor's official channels for patch releases.
- Consider using a security plugin with integrity monitoring to detect unauthorized code execution.
Share
External POC / Exploit Code
Leaving vuln.today