EUVD-2025-210137
GHSA-xwgf-8969-9fm2
Severity by source
AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:L
Race condition (AC:H) requires authenticated uploader (PR:L) and concurrent victim upload (UI:R); file overwrite yields high integrity, no confidentiality impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Iptanus File Upload WordPress plugin before 5.1.7 does not implement proper file handling when the duplicatepolicy setting is configured to "maintain both." Due to a Time-of-Check to Time-of-Use (TOCTOU) race condition between the file existence check and the actual file write operation, an authenticated attacker can overwrite files uploaded by other users.
AnalysisAI
Iptanus File Upload WordPress plugin before version 5.1.7 allows authenticated low-privilege users to overwrite other users' uploaded files by exploiting a Time-of-Check to Time-of-Use (TOCTOU) race condition in the plugin's file deduplication logic. The flaw is conditional on the duplicatepolicy setting being configured to 'maintain both,' and requires winning a precise timing race between the file existence check and the write operation. No active exploitation is confirmed by CISA KEV; however, a publicly available exploit exists via WPScan, and EPSS remains negligible at 0.01%, consistent with the high attack complexity required.
Technical ContextAI
The vulnerability is rooted in CWE-362 (Concurrent Execution Using Shared Resource with Improper Synchronization), commonly known as a TOCTOU race condition. When the duplicatepolicy setting is set to 'maintain both,' the plugin performs a file existence check before writing an uploaded file. The window between these two operations - the check and the write - can be exploited by a concurrent upload request, causing the plugin to overwrite an existing file rather than produce a uniquely named duplicate. The affected product is identified by CPE cpe:2.3:a:unknown:iptanus_file_upload:*:*:*:*:*:*:*:*, covering all plugin versions below 5.1.7 running within the WordPress ecosystem. Race conditions of this class are inherently probabilistic and generally require repeated attempts or high concurrency to exploit reliably.
RemediationAI
Update the Iptanus File Upload plugin to version 5.1.7 or later, which contains the vendor-released fix for this race condition. Until patching is feasible, administrators can eliminate the vulnerable code path entirely by changing the duplicatepolicy setting away from 'maintain both' - switching to 'overwrite' or 'reject' prevents the TOCTOU window from being exploitable, though this alters how duplicate filenames are handled and may affect expected upload behavior for end users. As a further access-control measure, restricting WordPress upload capabilities to the minimum necessary set of roles reduces the pool of potential authenticated attackers, but does not eliminate the vulnerability. The WPScan advisory at https://wpscan.com/vulnerability/06e33418-1644-49a1-b012-122046604109/ provides additional context. No compensating control fully substitutes for the patch.
Same weakness CWE-362 – Race Condition
View allSame technique Race Condition
View allShare
External POC / Exploit Code
Leaving vuln.today