PT-2025-36352 · WordPress · Multi Step Form

Tmrswrr · Published 2025-09-06 · Updated 2025-09-06 · CVE-2025-9515

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Multi Step Form plugin for WordPress versions prior to 1.7.26

Description The Multi Step Form plugin for WordPress is susceptible to arbitrary file uploads due to a lack of file type validation during the import process. This allows authenticated attackers with Administrator-level access or higher to upload arbitrary files to the affected server, potentially leading to remote code execution.

Recommendations Update the Multi Step Form plugin to version 1.7.26 or later.

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-9515

Affected Products

Multi Step Form

References · 8

• https://osv.dev/vulnerability/CVE-2025-9515 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-9515 · Security Note
• https://github.com/mlooft/multi-step-form/commit/590f9ac9d746b2a8aec0c12ba770252e86dc40ed · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/af7dbb61-90b1-4a61-819e-bcef88b12b7f?source=cve · Note
• https://t.me/CVEtracker/31844 · Telegram Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3351951%40multi-step-form&new=3351951%40multi-step-form&sfp_email=&sfph_mail= · Note
• https://twitter.com/CVEnew/status/1964195399700533681 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1964209166106407228 · Twitter Post