PT-2025-40491 · WordPress · Wp Dispatcher

Craig Webb · Published 2025-10-03 · Updated 2025-10-08 · CVE-2025-9212

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WP Dispatcher plugin for WordPress versions prior to 1.2.1

Description The WP Dispatcher plugin for WordPress is susceptible to arbitrary file uploads because of a lack of file type validation within the wp dispatcher process upload() function. This allows authenticated attackers with Subscriber-level access or higher to upload arbitrary files to the server. While an .htaccess file exists to limit the ability to achieve remote code execution, the possibility remains.

Recommendations Update the WP Dispatcher plugin to version 1.2.1 or later.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-9212

Affected Products

Wp Dispatcher

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-9212 · Security Note
• https://twitter.com/CVEnew/status/1974076242551836697 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/f0b9c46d-72db-43f3-b17b-0747375d45c9?source=cve · Note
• https://plugins.trac.wordpress.org/browser/wp-dispatcher/trunk/admin/class-wp-dispatcher-add-new-upload.php#L110 · Note
• https://twitter.com/cracbot/status/1975878901059531240 · Twitter Post