Cyber Posture

CVE-2025-10916

Critical

Published: 21 October 2025

Published
21 October 2025
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
EPSS Score 0.0013 32.4th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources.

Security Summary

CVE-2025-10916 is a vulnerability in the FormGent WordPress plugin versions before 1.0.4, caused by insufficient file path validation. This flaw allows arbitrary file deletion on the affected server.

Unauthenticated attackers can exploit this vulnerability remotely with low attack complexity and no user interaction or privileges required, as reflected in its CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H). Exploitation enables deletion of arbitrary files, resulting in high impacts to integrity and availability but no confidentiality loss.

WPScan advisories, referenced at https://wpscan.com/vulnerability/81c23998-1abb-495f-890a-79624a4cab9a/, indicate that updating to FormGent version 1.0.4 addresses the issue by improving file path validation.

Details

CWE(s)
None listed

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1070.004 File Deletion Stealth
Adversaries may delete files left behind by the actions of their intrusion activity.
attack.mitre.org →
T1485 Data Destruction Impact
Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources.
attack.mitre.org →
Why these techniques?

T1190 for exploiting public-facing WordPress plugin; T1070.004 and T1485 directly enabled by arbitrary file deletion capability.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References