PT-2025-36494 · WordPress · Doccure

István Márton · Published 2025-09-08 · Updated 2025-09-08 · CVE-2025-9113

Positive Technologies · (AI Summary)

CVSS v3.1

9.8

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions:

Doccure theme for WordPress versions through 1.4.8

Description:

The Doccure theme for WordPress is susceptible to arbitrary file uploads due to the absence of file type validation within the `doccure temp upload to media` function. This flaw allows unauthenticated attackers to upload arbitrary files to the server, potentially leading to remote code execution.

Recommendations:

Update the Doccure theme to a version beyond 1.4.8.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-9113

Affected Products

Doccure

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-9113 · Security Note
• https://twitter.com/CVEnew/status/1965124635340439650 · Twitter Post
• https://themeforest.net/item/doccure-medical-wordpress-theme/34329202 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/6ff01c24-fa35-43bc-be60-f2bb37854681?source=cve · Note
• https://twitter.com/VulmonFeeds/status/1965151738295382058 · Twitter Post