PT-2025-44236 · WordPress · Doppler Forms

Khaled Alenazi · CVE-2025-9544 · Published 2025-10-29 · Updated 2025-10-29

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Doppler Forms WordPress plugin versions through 2.5.1

Description The Doppler Forms WordPress plugin registers an AJAX action, install extension, without proper verification of user capabilities or the use of a nonce. This allows any authenticated user, even those with the Subscriber role, to install and activate additional Doppler Forms plugins, limited to those whitelisted by the main plugin.

Recommendations Update Doppler Forms WordPress plugin to a version later than 2.5.1.

Exploit

Fix

Related Identifiers

CVE-2025-9544

Affected Products

Doppler Forms

References · 3

• 🔥 https://wpscan.com/vulnerability/06312fba-dfc5-47af-afe3-b01d8941acbf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-9544 · Security Note
• https://t.me/CVEtracker/36022 · Telegram Post