Arbitrary File Upload Vulnerability in WP Dispatcher Plugin for WordPress by WordPress

CVE-2025-9212

What is CVE-2025-9212?

The WP Dispatcher plugin allows authenticated users with Subscriber-level access and above to upload arbitrary files due to inadequate file type validation in the wp_dispatcher_process_upload() function. This vulnerability affects all versions up to and including 1.2.0. Although there is an .htaccess file that restricts certain actions in the upload directory, this weakness can potentially allow attackers to upload harmful files, leading to remote code execution on the server.

References