Doppler Forms CVE-2025-9544

Requires an authenticated WordPress account of any role, including the lowest Subscriber role (PR:L), on a site running Doppler Forms ≤2.5.1 - exploitable where open user registration is enabled or any low-trust account can be obtained. The vulnerable install_extension AJAX action performs no capability check and no nonce verification, so no user interaction or elevated privileges are needed. Exploitation is bounded by the plugin's own whitelist: only Doppler-Forms-sanctioned extensions can be installed/activated, which limits attacker control over outcomes.

This is a genuine but moderate broken-access-control issue rather than a critical one. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, base 6.5) correctly reflects a network-reachable, low-complexity flaw requiring only low-privilege authentication and no user interaction, with pure integrity impact. EPSS is low (0.22%, 12th percentile), there is no CISA KEV listing, and no public exploit was identified - all signals point to no active or imminent widespread exploitation. The I:H rating appears somewhat generous: the description explicitly states installable/activatable plugins are 'limited to those whitelisted by the main Doppler Forms plugin,' which materially constrains what an attacker can actually achieve, so real-world integrity impact is bounded (I lean toward I:L, ~4.3). The provided 'Information Disclosure' tag conflicts with the CVSS vector, which shows C:N - this is an integrity/authorization flaw, not a confidentiality one; defenders should disregard the info-disclosure framing. Net: a real priority to patch on affected sites but not an emergency, especially given the whitelist constraint and low exploitation signals.

An attacker self-registers or obtains any low-privilege account (e.g., Subscriber) on a WordPress site running Doppler Forms ≤2.5.1, then sends a crafted authenticated POST to the unprotected admin-ajax.php install_extension action. Because the handler checks neither capability nor nonce, the request installs and activates an additional (whitelisted) Doppler Forms extension, altering site configuration without authorization. No public exploit code was identified at time of analysis, though the one-request nature makes exploitation straightforward.