The GB Forms DB plugin for WordPress contains a vulnerability in the gbfdb_talk_to_front() function that accepts user input and passes it to call_user_func. This flaw allows an attacker to execute arbitrary PHP code on the server without authentication, enabling the deployment of backdoors, creation of new administrative users, and other destructive activities.

GB Forms DB plugin for WordPress. All released versions up to and including 1.0.2 are vulnerable. The exploit is tied to the plugin’s gbfdb_talk_to_front() endpoint, which is invoked through the WordPress site.

The CVSS score of 9.8 classifies this vulnerability as critical, and the EPSS score indicates a very low probability of exploitation (<1%). It is not listed in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector is an unauthenticated HTTP request to the plugin’s front‑end function, which requires the plugin to be installed and publicly accessible. Successful exploitation would grant attackers full remote code execution and control over the affected server.