CVE-2025-9212

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-9212", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-08-19T19:33:21.414Z", "datePublished": "2025-10-03T11:17:22.865Z", "dateUpdated": "2026-04-08T17:32:18.689Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:32:18.689Z"}, "affected": [{"vendor": "ekndev", "product": "WP Dispatcher", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.2.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The WP Dispatcher plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the wp_dispatcher_process_upload() function in all versions up to, and including, 1.2.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. The directory does have an .htaccess file which limits the ability to achieve remote code execution."}], "title": "WP Dispatcher <= 1.2.0 - Authenticated (Subscriber+) Arbitrary File Upload", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f0b9c46d-72db-43f3-b17b-0747375d45c9?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-dispatcher/trunk/admin/class-wp-dispatcher-add-new-upload.php#L110"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type", "cweId": "CWE-434", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Craig Webb"}], "timeline": [{"time": "2025-10-02T22:18:10.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-03T18:25:25.273622Z", "id": "CVE-2025-9212", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-03T18:25:34.795Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-9212", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-03T18:25:25.273622Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-03T18:25:30.492Z"}}], "cna": {"title": "WP Dispatcher <= 1.2.0 - Authenticated (Subscriber+) Arbitrary File Upload", "credits": [{"lang": "en", "type": "finder", "value": "Craig Webb"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "ekndev", "product": "WP Dispatcher", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.2.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-02T22:18:10.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f0b9c46d-72db-43f3-b17b-0747375d45c9?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-dispatcher/trunk/admin/class-wp-dispatcher-add-new-upload.php#L110"}], "descriptions": [{"lang": "en", "value": "The WP Dispatcher plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the wp_dispatcher_process_upload() function in all versions up to, and including, 1.2.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. The directory does have an .htaccess file which limits the ability to achieve remote code execution."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-434", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:32:18.689Z"}}}, "cveMetadata": {"cveId": "CVE-2025-9212", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:32:18.689Z", "dateReserved": "2025-08-19T19:33:21.414Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-10-03T11:17:22.865Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "WP Dispatcher", "vendor": "ekndev", "versions": [{"lessThanOrEqual": "1.2.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The WP Dispatcher plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the wp_dispatcher_process_upload() function in all versions up to, and including, 1.2.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. The directory does have an .htaccess file which limits the ability to achieve remote code execution."}, {"lang": "es", "value": "El plugin WP Dispatcher para WordPress es vulnerable a la carga arbitraria de archivos debido a la falta de validaci\u00f3n del tipo de archivo en la funci\u00f3n wp_dispatcher_process_upload() en todas las versiones hasta la 1.2.0, inclusive. Esto permite a atacantes autenticados, con acceso de nivel Suscriptor y superior, cargar archivos arbitrarios en el servidor del sitio afectado, lo que puede hacer posible la ejecuci\u00f3n remota de c\u00f3digo. El directorio s\u00ed tiene un archivo .htaccess que limita la capacidad de lograr la ejecuci\u00f3n remota de c\u00f3digo."}], "id": "CVE-2025-9212", "lastModified": "2026-10-12T15:10:00.207", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-9212", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-03T18:25:25.273622Z", "version": "2.0.3"}}]}, "published": "2025-10-03T12:15:47.417", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-dispatcher/trunk/admin/class-wp-dispatcher-add-new-upload.php#L110"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f0b9c46d-72db-43f3-b17b-0747375d45c9?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-434"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-20T19:20:48.305486+00:00", "value": {"mitigation_remediation": ["Update WP Dispatcher to the latest released version or remove it if the plugin is no longer required.", "Disable or restrict the upload feature for subscriber-level users, ensuring that only administrators can upload files.", "Enforce strict file type validation on the server side, rejecting any uploads that are not explicitly allowed, and verify MIME types before storing them."], "summary": {"action": "Patch Immediately", "impact": "Arbitrary File Upload with possible remote code execution"}, "threat_synthesis": {"affected_systems": "The vulnerability affects ekndev\u2019s WP Dispatcher plugin for WordPress. All releases up to and including version 1.2.0 are susceptible. The issue exists on any WordPress site that has this plugin installed and grants subscribers the ability to create uploads.", "description_and_impact": "WP Dispatcher, a WordPress plugin, allows authenticated users with Subscriber level access or higher to upload files through the wp_dispatcher_process_upload() function. The function lacks file type validation, permitting arbitrary file uploads. An attacker who can authenticate to the site (e.g., a legitimate subscriber) could upload any file, including potentially executable scripts. Although the upload directory contains an .htaccess file that restricts remote execution, a successful upload could still allow an attacker to place a malicious file that the server might inadvertently execute, leading to remote code execution, data exfiltration, or site defacement.", "risk_and_exploitability": "The CVSS score of 7.5 indicates a high risk when exploited, yet the EPSS score of less than 1% signals a low probability of exploitation at this time, and the CVE is not listed in the CISA KEV catalog. Exploitation requires authenticated access, so the attack vector is an authenticated user with subscriber-level privileges. Once an attacker gains upload capability, they could immediately upload a malicious script and potentially trigger remote code execution, depending on the server configuration. This underscores the importance of timely remediation."}}}}, "created": "2025-10-06T14:43:07.198375+00:00", "updated": "2026-04-20T19:30:06.161308+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}