EUVD-2025-210834
GHSA-f4rp-wjf2-c8p8
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network file upload with no user interaction leading to webshell RCE yields full confidentiality, integrity, and availability impact; PR:N and AC:L match the exposed handler.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
3DescriptionCVE.org
The Developer Tools WordPress plugin through 1.1.3 contains an unauthenticated arbitrary file upload vulnerability in the bundled SWFUpload component
Articles & Coverage 1
AnalysisAI
Unauthenticated arbitrary file upload in the Developer Tools WordPress plugin (versions through 1.1.3) lets remote attackers upload malicious files via the bundled, legacy SWFUpload component, typically leading to remote code execution when a PHP webshell is placed in a web-accessible directory. Any WordPress site running this plugin at or below 1.1.3 is exposed with no authentication required. Publicly available exploit code exists (reported by WPScan), though there is no public evidence of active exploitation.
Technical ContextAI
The flaw resides in SWFUpload, an obsolete Adobe Flash-based multi-file upload library historically bundled into many WordPress plugins and known for a long history of security issues. The plugin exposes SWFUpload's upload handler without enforcing authentication, capability checks, nonce validation, or server-side file-type/extension restrictions, so an attacker can POST an arbitrary file (e.g. a .php script) to the endpoint. Although the input lists CWE as N/A, this is a textbook CWE-434 (Unrestricted Upload of File with Dangerous Type) root cause. The CPE 'cpe:2.3:a:unknown:developer_tools' identifies the affected component, but its vendor field 'unknown' is a placeholder rather than a real vendor; the affected software is the 'Developer Tools' WordPress plugin.
RemediationAI
No vendor-released patch version was identified at time of analysis, so if no fixed release is confirmed via the WPScan advisory (https://wpscan.com/vulnerability/0b1d9bfa-f7fa-4c6b-a310-699a47267e51/), the safest action is to deactivate and remove the Developer Tools plugin entirely, since it bundles the deprecated and unmaintained SWFUpload library. As compensating controls until removal, block or restrict access to the plugin's SWFUpload upload handler at the web server or WAF layer (deny external POSTs to the upload endpoint), and configure the server to prevent execution of PHP within WordPress upload directories (e.g. wp-content/uploads) - noting this breaks any legitimate feature that relies on that upload path. Restricting the endpoint or disabling script execution in upload folders may interfere with intended plugin functionality, so validate against site behavior before enforcing.
More in Developer Tools
View allA privilege escalation flaw was found in Podman. Rated high severity (CVSS 8.8), this vulnerability is remotely exploita
Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing an invalid DSA
Go before 1.8.4 and 1.9.x before 1.9.1 allows "go get" remote command execution. Rated critical severity (CVSS 9.8), thi
An issue was discovered in net/http in Go 1.11.5. Rated medium severity (CVSS 6.1), this vulnerability is remotely explo
A use-after-free flaw was found in the Linux kernel’s FUSE filesystem in the way a user triggers write(). Rated high sev
A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the way a user may r
A flaw was found in Podman, where containers were started incorrectly with non-empty default permissions. Rated high sev
Go before 1.12.10 and 1.13.x before 1.13.1 allow HTTP Request Smuggling. Rated high severity (CVSS 7.5), this vulnerabil
Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. Rated high seve
Same technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today