Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2025-9314: Developer Tools plugin lets anyone upload files
CVE-2025-9314 · published 1 day ago
Summary
The WordPress Developer Tools plugin (versions up to 1.1.3) allows anyone on the internet to place files onto your site without logging in, using a built‑in upload feature. This could let attackers add malicious scripts or replace existing files, potentially taking control of the site. Update the plugin to the latest version or remove it if you do not need it, and check your site for any unauthorized files.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| unknown | developer tools | <= 1.1.3 |
Original advisory text
Developer Tools <= 1.1.3 – Unauthenticated Arbitrary File Upload
The Developer Tools WordPress plugin through 1.1.3 contains an unauthenticated arbitrary file upload vulnerability in the bundled SWFUpload component
Severity
9.8
Critical
CVSS 3.1: 9.8 (NVD)
Type
CWE-434Unrestricted File Upload
Timeline
Published2 Sep 2026
Updated2 Sep 2026
First seen2 Sep 2026
Monitor software like this
Free during beta