Developer Tools CVE-2025-9314

The target WordPress site must have the Developer Tools plugin installed and active at version 1.1.3 or earlier, with the bundled SWFUpload upload handler reachable over the network. No authentication, user interaction, or non-default configuration is required per the CVSS vector (PR:N/UI:N/AC:L). The main limiting factor is deployment scope - only sites actually running this specific, relatively niche plugin are exposed - and successful RCE additionally depends on the upload landing in a directory where the server will execute PHP.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, score 9.8) reflects a worst-case network, low-complexity, unauthenticated path with full CIA impact, which is credible for a working arbitrary-file-upload-to-RCE primitive. Publicly available exploit code (WPScan) meaningfully raises real-world risk and lowers the bar for opportunistic attackers, and WordPress plugin upload flaws are frequently swept up by automated mass-scanning tooling. No EPSS score, KEV listing, or SSVC decision data was provided, so exploitation-in-the-wild cannot be confirmed and automatability can only be inferred from the unauthenticated network vector; treat the 9.8 as plausible but note the missing corroborating signals. Given a public PoC against a low-complexity unauthenticated endpoint, defenders should prioritize this as urgent even though active exploitation is not confirmed.

An attacker scanning for WordPress sites running the Developer Tools plugin sends a crafted multipart POST to the exposed SWFUpload handler, uploading a PHP webshell without any credentials. Because no file-type validation is enforced, the file lands in a web-accessible directory and the attacker browses to it to execute commands, achieving full site compromise. Publicly available exploit code makes this scenario low-effort and repeatable.