Arbitrary File Upload Vulnerability in Embed PDF for WPForms by WordPress
CVE-2025-10647
8.8HIGH
What is CVE-2025-10647?
The Embed PDF for WPForms plugin for WordPress is susceptible to arbitrary file uploads due to insufficient file type validation in its ajax_handler_download_pdf_media function. This vulnerability affects all versions up to and including 1.1.5, allowing authenticated attackers, who have Subscriber-level access or higher, to upload unauthorized files to the server hosting the affected site. If exploited, this could potentially lead to remote code execution, compromising the security of the affected installations.
Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.
Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.
Affected Version(s)
Embed PDF for WPForms * <= 1.1.5
References
CVSS V3.1
Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Youcef Hamdani