CVE-2025-9314
Received Received - Intake

Unauthenticated Arbitrary File Upload in WordPress Developer Tools Plugin

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: WPScan

Description
The Developer Tools WordPress plugin through 1.1.3 contains an unauthenticated arbitrary file upload vulnerability in the bundled SWFUpload component

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2025-9314
EUVD
EUVD-2025-210834

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
developer_tools wordpress_plugin 1.1.3
developer_tools developer_tools to 1.1.3 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Developer Tools WordPress plugin through version 1.1.3 has an unauthenticated arbitrary file upload vulnerability in its bundled SWFUpload component. This allows attackers to upload malicious files without authentication by exploiting a flaw in the plugin.

Detection Guidance

Check for unexpected PHP files in WordPress upload directories, particularly under /wp-content/uploads/ with recent timestamps. Look for files with unusual names or extensions. Review server access logs for POST requests to /wp-content/plugins/developer-tools/ or similar paths.

Impact Analysis

An attacker can upload a malicious PHP file to your WordPress site, which can then be executed remotely. This could lead to full control of your website, data theft, or further attacks on visitors. The uploaded files are stored in predictable paths like /wp-content/uploads/2025/08/nx.php.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection and security. Organizations may face legal penalties, reputational damage, and loss of compliance certifications if exploited.

Mitigation Strategies

Disable or uninstall the Developer Tools plugin immediately. Restrict write permissions to WordPress upload directories. Monitor for suspicious file uploads or unexpected network activity. Consider blocking access to /wp-content/uploads/ via web server rules if not required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-9314. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart