CVE-2025-6691: Brainstormforce Sureforms RCE Vulnerability

CVE-2025-6691 Overview

CVE-2025-6691 is an arbitrary file deletion vulnerability in the SureForms – Drag and Drop Form Builder for WordPress plugin developed by Brainstormforce. The flaw resides in the delete_entry_files() function and affects all versions up to and including 1.7.3. Insufficient file path validation allows unauthenticated attackers to delete arbitrary files on the underlying server. Deleting critical files such as wp-config.php triggers WordPress to enter its setup state, enabling attackers to pivot to remote code execution by reconfiguring the site against an attacker-controlled database. The vulnerability is tracked under CWE-73: External Control of File Name or Path and CWE-610: Externally Controlled Reference to a Resource in Another Sphere.

Critical Impact

Unauthenticated attackers can delete arbitrary files on WordPress servers running SureForms <= 1.7.3, leading to site takeover and remote code execution.

Affected Products

• SureForms – Drag and Drop Form Builder for WordPress (plugin slug: sureforms)
• All versions up to and including 1.7.3
• WordPress sites using Brainstormforce SureForms with form entry handling enabled

Discovery Timeline

• 2025-07-09 - CVE-2025-6691 published to the National Vulnerability Database
• 2025-07-11 - Last updated in NVD database

Technical Details for CVE-2025-6691

Vulnerability Analysis

The vulnerability resides in the delete_entry_files() function defined in admin/views/entries-list-table.php of the SureForms plugin. The function processes file paths associated with form entry submissions but does not validate or constrain those paths to the plugin's intended upload directory. Because the path is treated as externally controlled input, an attacker can supply a relative or absolute path that traverses outside the entries directory. The function then passes the attacker-controlled path to PHP's file deletion routines, removing whatever file the web server user has permission to delete.

Deletion alone produces integrity and availability impact, but the WordPress architecture amplifies the consequence. When wp-config.php is removed, WordPress treats the installation as new and presents the initial setup wizard. An attacker reaching this state can configure the site against a database they control, install a malicious administrator account, and execute arbitrary PHP through the theme or plugin editor. This chain converts a file deletion primitive into full remote code execution.

Root Cause

The root cause is insufficient file path validation in delete_entry_files(). The function does not canonicalize the submitted path, does not enforce a directory allowlist, and does not verify that the resolved path remains within the SureForms uploads directory. Authentication and capability checks on the deletion entry point are also absent, which is why the issue is exploitable by unauthenticated actors.

Attack Vector

Exploitation occurs over the network against a vulnerable WordPress site. The attacker triggers the SureForms entry deletion handler with a crafted file path parameter referencing a file outside the entries directory. User interaction is required as indicated by the CVSS vector, typically through an authenticated administrator action being induced or through a workflow that the plugin exposes. Once wp-config.php is deleted, the attacker visits the WordPress installer to seize control of the site.

No proof-of-concept exploit is publicly listed, and the issue is not currently tracked in the CISA Known Exploited Vulnerabilities catalog. Technical details are available in the Wordfence Vulnerability Report and the WordPress plugin source view.

Detection Methods for CVE-2025-6691

Indicators of Compromise

• Missing or recently deleted wp-config.php, .htaccess, or core WordPress files on hosts running SureForms <= 1.7.3.
• WordPress installer page (/wp-admin/install.php) unexpectedly reachable on a previously configured site.
• Web server access logs showing POST requests to SureForms admin-ajax or entries endpoints with ..\/ or absolute path values in file parameters.
• Unexpected creation of administrator accounts following file deletion events.

Detection Strategies

• Inspect web server logs for requests targeting SureForms entry deletion handlers containing path traversal sequences or references to files outside the plugin uploads directory.
• Monitor file integrity on WordPress installations and alert when sensitive files such as wp-config.php, wp-load.php, or index.php are removed or modified.
• Correlate plugin activity logs with file system delete events to flag anomalous deletions originating from the web server process.

Monitoring Recommendations

• Enable WordPress audit logging to capture plugin actions, entry deletions, and administrator account changes.
• Track outbound requests from the web server immediately after deletion events to detect installer-stage attacker infrastructure.
• Subscribe to vulnerability feeds covering Brainstormforce plugins and ingest them into your vulnerability management workflow.

How to Mitigate CVE-2025-6691

Immediate Actions Required

• Update SureForms to a version newer than 1.7.3 as released by Brainstormforce.
• Audit the WordPress installation for missing core or configuration files and restore from a known-good backup if tampering is detected.
• Review administrator accounts and revoke any unrecognized users created after July 9, 2025.
• Rotate database credentials and WordPress salts defined in wp-config.php if file deletion or replacement is suspected.

Patch Information

Brainstormforce addressed the issue in a fix tracked in the SureForms plugin changeset 3319753. The patch adds path validation to delete_entry_files() so deletion operations remain constrained to the plugin's intended directory. Updated releases are available through the official SureForms plugin page.

Workarounds

• Disable or remove the SureForms plugin until the patched version is applied.
• Restrict access to wp-admin endpoints by IP allowlist at the web server or web application firewall layer.
• Set restrictive file system permissions so the web server user cannot delete wp-config.php or other WordPress core files.
• Deploy a WAF rule that blocks requests to SureForms entry deletion endpoints containing path traversal patterns or absolute paths.

# Configuration example: enforce restrictive permissions on wp-config.php
chown root:www-data /var/www/html/wp-config.php
chmod 440 /var/www/html/wp-config.php

# Verify the SureForms plugin version installed via WP-CLI
wp plugin get sureforms --field=version

# Update SureForms to the patched release
wp plugin update sureforms