{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-9515", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-08-26T21:28:38.847Z", "datePublished": "2025-09-06T02:24:17.551Z", "dateUpdated": "2026-04-08T17:15:37.056Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:15:37.056Z"}, "affected": [{"vendor": "mondula2016", "product": "Multi Step Form", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.7.25", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Multi Step Form plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the import functionality in all versions up to, and including, 1.7.25. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible."}], "title": "Multi Step Form <= 1.7.25 - Authenticated (Admin+) Arbitrary File Upload", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/af7dbb61-90b1-4a61-819e-bcef88b12b7f?source=cve"}, {"url": "https://github.com/mlooft/multi-step-form/commit/590f9ac9d746b2a8aec0c12ba770252e86dc40ed"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3351951%40multi-step-form&new=3351951%40multi-step-form&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type", "cweId": "CWE-434", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.2, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "tmrswrr"}], "timeline": [{"time": "2025-08-28T08:23:05.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-09-05T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-08T20:13:25.362501Z", "id": "CVE-2025-9515", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-08T20:13:32.351Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-9515", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-08T20:13:25.362501Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-08T20:13:29.188Z"}}], "cna": {"title": "Multi Step Form <= 1.7.25 - Authenticated (Admin+) Arbitrary File Upload", "credits": [{"lang": "en", "type": "finder", "value": "tmrswrr"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.2, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "mondula2016", "product": "Multi Step Form", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "1.7.25"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-08-28T08:23:05.000+00:00", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-09-05T00:00:00.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/af7dbb61-90b1-4a61-819e-bcef88b12b7f?source=cve"}, {"url": "https://github.com/mlooft/multi-step-form/commit/590f9ac9d746b2a8aec0c12ba770252e86dc40ed"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3351951%40multi-step-form&new=3351951%40multi-step-form&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The Multi Step Form plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the import functionality in all versions up to, and including, 1.7.25. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-434", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-09-06T02:24:17.551Z"}}}, "cveMetadata": {"cveId": "CVE-2025-9515", "state": "PUBLISHED", "dateUpdated": "2025-09-08T20:13:32.351Z", "dateReserved": "2025-08-26T21:28:38.847Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-09-06T02:24:17.551Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Multi Step Form plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the import functionality in all versions up to, and including, 1.7.25. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible."}], "id": "CVE-2025-9515", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2025-09-06T03:15:41.793", "references": [{"source": "security@wordfence.com", "url": "https://github.com/mlooft/multi-step-form/commit/590f9ac9d746b2a8aec0c12ba770252e86dc40ed"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3351951%40multi-step-form&new=3351951%40multi-step-form&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/af7dbb61-90b1-4a61-819e-bcef88b12b7f?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-434"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-20T19:43:18.259869+00:00", "value": {"mitigation_remediation": ["Upgrade the Multi Step Form plugin to a version newer than 1.7.25, if an update is available.", "If the plugin cannot be updated, immediately disable or remove the import functionality, or uninstall the plugin altogether to eliminate the upload path.", "Configure WordPress to restrict uploaded files to non\u2011executable MIME types and ensure that the upload directory is not web\u2011executable, thereby reducing the risk of code execution from uploaded files."], "summary": {"action": "Patch Immediately", "impact": "Remote Code Execution (potential) via arbitrary file upload"}, "threat_synthesis": {"affected_systems": "This vulnerability affects installations of the Multi Step Form plugin created by mondula2016. All releases up to and including version 1.7.25 are impacted. The issue is specific to WordPress sites that rely on this plugin and does not extend to other WordPress components or third\u2011party plugins.", "description_and_impact": "The Multi Step Form plugin for WordPress contains a flaw in its import functionality that fails to validate the type of uploaded files. An attacker who has Administrator privileges can exploit this issue to upload any file to the site\u2019s server, including scripts or executables that, if placed in a web-accessible directory, could be run by the web server. The absence of file\u2011type checks means that the attack does not rely on other weaknesses, placing the core vulnerability in the category of unrestricted upload, which can lead to remote code execution.", "risk_and_exploitability": "The CVSS score of 7.2 places the vulnerability in the high category, while the EPSS score of <1% indicates a low probability of exploitation at present. The plugin is not listed in CISA\u2019s KEV catalog. Attackers must first obtain Administrator level access to the WordPress site, which limits the threat to sites with poor internal controls or compromised admin credentials. Once satisfied, an attacker can use the import feature to drop malicious files, potentially enabling execution of arbitrary code or further compromise of the server."}}}}, "created": "2026-04-20T19:45:15.512587+00:00", "updated": "2026-04-20T19:45:15.512599+00:00", "vendors": []}