PT-2025-38519 · WordPress+1 · Embed Pdf For Wpforms+1
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Embed PDF for WPForms plugin for WordPress versions up to and including 1.1.5
Description
The Embed PDF for WPForms plugin for WordPress is susceptible to arbitrary file uploads due to the absence of file type validation within the
ajax handler download pdf media function. This allows authenticated attackers with Subscriber-level access or higher to upload arbitrary files to the affected server, potentially leading to remote code execution.Recommendations
Update the Embed PDF for WPForms plugin to a version beyond 1.1.5.
Fix
RCE
Unrestricted File Upload
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Embed Pdf For Wpforms
Wpforms