Remote Code Execution Vulnerability in GB Forms DB Plugin for WordPress

CVE-2025-5392

What is CVE-2025-5392?

The GB Forms DB plugin for WordPress contains a significant vulnerability that allows remote code execution due to improper handling of user input in the gbfdb_talk_to_front() function. This function processes unvalidated user input and subsequently uses call_user_func(), enabling unauthenticated attackers to execute arbitrary code on the server. Such exploitation can lead to severe security risks, including unauthorized code injection, potential backdoor access, and the creation of new administrative accounts.

References