What is the CVSS score of EUVD-2025-21121?

EUVD-2025-21121 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Which versions of PHP are affected by EUVD-2025-21121?

A critical vulnerability in the GB Forms DB WordPress plugin allows unauthenticated attackers to execute arbitrary code on affected servers with a 9.8 CVSS score.

How to fix or mitigate EUVD-2025-21121?

Within 24 hours: Identify all WordPress instances using GB Forms DB plugin and disable or remove it immediately; enable Web Application Firewall (WAF) rules to block exploitation attempts. Within 7 days: Conduct forensic analysis of affected systems for signs of compromise (new admin accounts, backdoors, suspicious code); reset all WordPress credentials and review access logs. Within 30 days: Migrate to an alternative forms solution with active security maintenance; implement plugin vulnerability scanning and approval workflows to prevent similar exposures.

PHP EUVD-2025-21121

| CVE-2025-5392 CRITICAL

Code Injection (CWE-94)

2025-07-11 security@wordfence.com

WordPress RCE PHP

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 16, 2026 - 08:17 euvd

EUVD-2025-21121

Analysis Generated

Mar 16, 2026 - 08:17 vuln.today

CVE Published

Jul 11, 2025 - 07:15 nvd

CRITICAL 9.8

DescriptionCVE.org

The GB Forms DB plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0.2 via the gbfdb_talk_to_front() function. This is due to the function accepting user input and then passing that through call_user_func(). This makes it possible for unauthenticated attackers to execute code on the server which can be leverage to inject backdoors or create new administrative user accounts to name a few things.

AnalysisAI

The GB Forms DB plugin for WordPress contains a critical unauthenticated Remote Code Execution vulnerability in the gbfdb_talk_to_front() function, affecting all versions up to 1.0.2. The vulnerability stems from unsanitized user input passed directly to call_user_func(), allowing attackers to execute arbitrary PHP code without authentication. This can be leveraged to inject backdoors, create administrative accounts, or achieve full server compromise.

Technical ContextAI

The vulnerability exists in the GB Forms DB WordPress plugin and represents a CWE-94 (Improper Control of Generation of Code) weakness. The gbfdb_talk_to_front() function accepts user-controlled input and passes it directly to PHP's call_user_func() without validation or sanitization. call_user_func() is a dangerous function when combined with untrusted input, as it can dynamically execute any callable function or method in the PHP environment. The attack vector is network-based with no authentication required, making this a pre-authentication code execution flaw. Affected systems are WordPress installations with the GB Forms DB plugin active.

RemediationAI

IMMEDIATE: Deactivate and remove the GB Forms DB plugin if version 1.0.2 or earlier is installed.
Check plugin repository or vendor website for patched versions beyond 1.0.2 and upgrade immediately when available.
If a patch is not available, remove the plugin entirely until a secure version is released.
Audit server logs (web server, WordPress audit logs if available) for exploitation attempts targeting AJAX endpoints or the gbfdb_talk_to_front function.
Check for unauthorized administrative accounts or backdoor files created during the vulnerability window.
Implement Web Application Firewall (WAF) rules to block requests to known vulnerable endpoints if the plugin cannot be immediately removed.
Monitor WordPress security advisories and the plugin vendor's official channels for patch releases.
Consider using a security plugin with integrity monitoring to detect unauthorized code execution.