PT-2025-44236 · WordPress · Doppler Forms

Khaled Alenazi · CVE-2025-9544 · Publicado 2025-10-29 · Atualizado 2025-10-29

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Doppler Forms WordPress plugin versions through 2.5.1

Description The Doppler Forms WordPress plugin registers an AJAX action, install extension, without proper verification of user capabilities or the use of a nonce. This allows any authenticated user, even those with the Subscriber role, to install and activate additional Doppler Forms plugins, limited to those whitelisted by the main plugin.

Recommendations Update Doppler Forms WordPress plugin to a version later than 2.5.1.

Exploit

Correção

Identificadores relacionados

CVE-2025-9544

Produtos afetados

Doppler Forms

Referências · 3

• 🔥 https://wpscan.com/vulnerability/06312fba-dfc5-47af-afe3-b01d8941acbf · Exploit
• https://t.me/CVEtracker/36022 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2025-9544 · Nota de Segurança