PT-2025-36493 · WordPress · Doccure

István Márton · Published 2025-09-08 · Updated 2025-09-09 · CVE-2025-9112

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Doccure theme for WordPress versions through 1.4.8

Description: The Doccure theme for WordPress is susceptible to arbitrary file uploads due to inadequate file type validation within the doccure temp file uploader function. Authenticated attackers possessing subscriber-level permissions or higher can upload arbitrary files to the server, potentially leading to remote code execution.

Recommendations: Update Doccure theme to a version newer than 1.4.8.

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-9112

Affected Products

Doccure

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-9112 · Security Note
• https://t.me/CVEtracker/31983 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1965149178280944112 · Twitter Post
• https://twitter.com/CVEnew/status/1965124636405838138 · Twitter Post
• https://themeforest.net/item/doccure-medical-wordpress-theme/34329202 · Note
• https://t.me/cveNotify/134820 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/2f38498d-0560-4935-b1f5-1fdb62f49a5b?source=cve · Note