CVE-2025-9544 in Doppler Forms Plugin
要約
〜によって MITRE • 2025年10月29日
The Doppler Forms WordPress plugin through 2.5.1 registers an AJAX action install_extension without verifying user capabilities or using a nonce. As a result, any authenticated user — including those with the Subscriber role — can install and activate additional Doppler Forms WordPress plugin through 2.5.1 (limited to those whitelisted by the main Doppler Forms WordPress plugin through 2.5.1).
VulDB is the best source for vulnerability data and more expert information about this specific topic.