Arbitrary File Upload Vulnerability in Embed PDF for WPForms by WordPress

CVE-2025-10647

What is CVE-2025-10647?

The Embed PDF for WPForms plugin for WordPress is susceptible to arbitrary file uploads due to insufficient file type validation in its ajax_handler_download_pdf_media function. This vulnerability affects all versions up to and including 1.1.5, allowing authenticated attackers, who have Subscriber-level access or higher, to upload unauthorized files to the server hosting the affected site. If exploited, this could potentially lead to remote code execution, compromising the security of the affected installations.

References