CVE-2025-4659

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

The Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.4.4. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published: May 30, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-465906.5Bypass vulnerability in the network search instruction authentication module Impact: Successful exploitation of this vulnerability can bypas CVE-2025-465915.5Out-of-bounds data read vulnerability in the authorization module Impact: Successful exploitation of this vulnerability may affect service c CVE-2025-465925.5Null pointer dereference vulnerability in the USB HDI driver module Impact: Successful exploitation of this vulnerability may affect availab CVE-2025-465935.5Process residence vulnerability in abnormal scenarios in the print module Impact: Successful exploitation of this vulnerability may affect a CVE-2025-465956.4An XSS issue was discovered in the Flag module before 1.x-3.6.2 for Backdrop CMS. Flag is a module that allows flags to be added to nodes, c CVE-2025-465977.5Bitcoin Core 0.13.0 through 29.x has an integer overflow.CVE-2025-465985.3Bitcoin Core through 29.0 allows a denial of service via a crafted transaction.CVE-2025-465996.8CNCF K3s 1.32 before 1.32.4-rc1+k3s1 has a Kubernetes kubelet configuration change with the unintended consequence that, in some situations,CVE-2025-46609.8A remote code execution vulnerability exists in the Windows agent component of SecureConnector due to improper access controls on a named pi CVE-2025-466025.5Dell SupportAssist OS Recovery, versions prior to 5.5.15.0, contain an Insertion of Sensitive Information into Externally-Accessible File or CVE-2025-466037.5Dell CloudBoost Virtual Appliance, versions 19.13.0.0 and prior, contains an Improper Restriction of Excessive Authentication Attempts vulne CVE-2025-466057.2Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 8.4 through 8.5 contain a session fixati