CVE-2025-5392: 
WordPress vulnerability analysis and mitigation

The GB Forms DB plugin for WordPress contains a Remote Code Execution vulnerability (CVE-2025-5392) discovered in all versions up to and including 1.0.2. The vulnerability was disclosed on July 11, 2025 and affects the gbfdb_talk_to_front() function (NVD).

The vulnerability exists in the gbfdb_talk_to_front() function which accepts user input and passes it directly through call_user_func(). This implementation allows unauthenticated attackers to execute arbitrary code on the server. The vulnerability has been assigned a CVSS v3.1 score of 9.8 CRITICAL (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is classified as CWE-94 (Improper Control of Generation of Code) (NVD, Wordfence).

The vulnerability allows unauthenticated attackers to execute arbitrary code on the affected server. This can be exploited to inject backdoors, create new administrative user accounts, or perform other malicious actions with system-level privileges (NVD).

Users should immediately update to a version newer than 1.0.2 when available. Until a patch is released, it is recommended to remove or disable the GB Forms DB plugin to prevent potential exploitation (NVD).