CVE-2025-5392

The GB Forms DB plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0.2 via the gbfdb_talk_to_front() function. This is due to the function accepting user input and then passing that through call_user_func(). This makes it possible for unauthenticated attackers to execute code on the server which can be leverage to inject backdoors or create new administrative user accounts to name a few things.

• CWE-94

• https://plugins.trac.wordpress.org/browser/gb-forms-db/trunk/core/functions.php#L334
• https://plugins.trac.wordpress.org/browser/gb-forms-db/trunk/core/functions.php#L367
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3323703%40gb-forms-db&new=3323703%40gb-forms-db&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/fe8723a7-bbb1-41a0-b222-3cf4eb44cd64?source=cve

Published

Jul 11, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-5391The WooCommerce Purchase Orders plugin for WordPress is vuln…8.1
• CVE-2025-53910Mattermost Confluence Plugin version <1.5.0 fails to check t…4
• CVE-2025-53912An arbitrary file read vulnerability exists in the encapsula…8.1
• CVE-2025-53913Excessive Privileges vulnerability in Calix GigaCenter ONT (…7
• CVE-2025-53914Excessive Privileges vulnerability in Calix GigaCenter ONT (…7
• CVE-2025-53919An issue was discovered in the Portrait Dell Color Managemen…7.8
• CVE-2025-53922Galette is a membership management web application for non p…4.9
• CVE-2025-53923Emlog is an open source website building system. A cross-sit…6.1
• CVE-2025-53924Emlog is an open source website building system. A cross-sit…4.8
• CVE-2025-53925Emlog is an open source website building system. A cross-sit…5.4
• CVE-2025-53926Emlog is an open source website building system. A cross-sit…6.1
• CVE-2025-53927MaxKB is an open-source AI assistant for enterprise. Prior t…6.3