CVE-2025-6782

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-6782", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-06-27T12:16:12.131Z", "datePublished": "2025-07-04T01:44:05.670Z", "dateUpdated": "2026-04-08T17:26:52.209Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:26:52.209Z"}, "affected": [{"vendor": "optinlyhq", "product": "GoZen Forms", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.1.5", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The GoZen Forms plugin for WordPress is vulnerable to SQL Injection via the 'forms-id' parameter of the dirGZActiveForm() function in all versions up to, and including, 1.1.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}], "title": "GoZen Forms <= 1.1.5 - Unauthenticated SQL Injection via dirGZActiveForm()", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d874a041-1cd4-4ca1-85bd-4050630d8502?source=cve"}, {"url": "https://wordpress.org/plugins/gozen-forms/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "cweId": "CWE-89", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Jonas Benjamin Friedli"}], "timeline": [{"time": "2025-07-03T12:18:38.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-07-07T14:06:06.811420Z", "id": "CVE-2025-6782", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-07T15:02:04.183Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-6782", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-07-07T14:06:06.811420Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-07T14:06:07.810Z"}}], "cna": {"title": "GoZen Forms <= 1.1.5 - Unauthenticated SQL Injection via dirGZActiveForm()", "credits": [{"lang": "en", "type": "finder", "value": "Jonas Benjamin Friedli"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}}], "affected": [{"vendor": "optinlyhq", "product": "GoZen Forms", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.1.5"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-07-03T12:18:38.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d874a041-1cd4-4ca1-85bd-4050630d8502?source=cve"}, {"url": "https://wordpress.org/plugins/gozen-forms/"}], "descriptions": [{"lang": "en", "value": "The GoZen Forms plugin for WordPress is vulnerable to SQL Injection via the 'forms-id' parameter of the dirGZActiveForm() function in all versions up to, and including, 1.1.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:26:52.209Z"}}}, "cveMetadata": {"cveId": "CVE-2025-6782", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:26:52.209Z", "dateReserved": "2025-06-27T12:16:12.131Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-07-04T01:44:05.670Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "GoZen Forms", "vendor": "optinlyhq", "versions": [{"lessThanOrEqual": "1.1.5", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:optinlyhq:gozen_forms:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "DBEED8BD-C508-4E97-B393-6A151E444944", "versionEndIncluding": "1.1.5", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The GoZen Forms plugin for WordPress is vulnerable to SQL Injection via the 'forms-id' parameter of the dirGZActiveForm() function in all versions up to, and including, 1.1.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}, {"lang": "es", "value": "El complemento GoZen Forms para WordPress es vulnerable a la inyecci\u00f3n SQL a trav\u00e9s del par\u00e1metro 'forms-id' de la funci\u00f3n dirGZActiveForm() en todas las versiones hasta la 1.1.5 incluida, debido a un escape insuficiente del par\u00e1metro proporcionado por el usuario y a la falta de preparaci\u00f3n de la consulta SQL existente. Esto permite a atacantes no autenticados a\u00f1adir consultas SQL adicionales a las consultas ya existentes, que pueden utilizarse para extraer informaci\u00f3n confidencial de la base de datos."}], "id": "CVE-2025-6782", "lastModified": "2026-06-17T10:02:33.917", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-6782", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-07-07T14:06:06.811420Z", "version": "2.0.3"}}]}, "published": "2025-07-04T03:15:22.913", "references": [{"source": "security@wordfence.com", "tags": ["Product"], "url": "https://wordpress.org/plugins/gozen-forms/"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d874a041-1cd4-4ca1-85bd-4050630d8502?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T19:52:04.628019+00:00", "value": {"mitigation_remediation": ["Install the latest GoZen Forms plugin version (\u2265\u202f1.1.6), or remove the plugin entirely if it is not required.", "If an upgrade is not immediately possible, disable access to the dirGZActiveForm() endpoint for unauthenticated users by restricting the URL via .htaccess, web\u2011application firewall rules, or a reverse\u2011proxy configuration.", "Implement input validation on the forms\u2011id parameter to reject non\u2011numeric values or otherwise sanitize user input before it reaches the database."], "summary": {"action": "Patch", "impact": "SQL Injection"}, "threat_synthesis": {"affected_systems": "Affected are installations of the optinlyhq GoZen Forms plugin for WordPress that are version 1.1.5 or earlier. The vulnerability exists in all releases up to and including 1.1.5 and can be exploited on any WordPress installation that has the plugin enabled and accessible to external users.", "description_and_impact": "The GoZen Forms WordPress plugin contains a vulnerability in the dirGZActiveForm() function; the forms-id parameter is not properly escaped or prepared in the underlying SQL statement. An unauthenticated attacker can supply a crafted forms-id value that appends additional SQL statements, allowing the injection of arbitrary queries. This defect is classified as CWE\u201189 and permits attackers to retrieve sensitive database data such as user credentials, content, and configuration information, thereby compromising confidentiality of the WordPress site and its database.", "risk_and_exploitability": "The CVSS score of 7.5 places this issue in the high\u2011severity range, indicating a significant risk if uncovered. However, the EPSS score is below 1\u202f%, implying that real\u2011world exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. Attackers can call the dirGZActiveForm() endpoint directly from a web browser or via automated scripts by supplying a malicious forms-id parameter, without needing any authentication. The likely attack vector is unauthenticated access to the dirGZActiveForm() endpoint."}}}}, "created": "2025-07-13T21:47:36.075602+00:00", "updated": "2026-04-21T20:00:25.895689+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}