CVE-2025-10647: Embed PDF for WPForms <= 1.1.5 - Authenticated (Subscriber+) Arbitrary File Upload
The Embed PDF for WPForms plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajaxhandlerdownloadpdfmedia function in all versions up to, and including, 1.1.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-10647?
CVE-2025-10647 is rated as a high severity vulnerability due to the potential for arbitrary file uploads.
How do I fix CVE-2025-10647?
To fix CVE-2025-10647, update the Embed PDF for WPForms plugin to the latest version beyond 1.1.5.
Who is affected by CVE-2025-10647?
CVE-2025-10647 affects all versions of the Embed PDF for WPForms plugin up to and including version 1.1.5.
What type of attack can exploit CVE-2025-10647?
CVE-2025-10647 can be exploited by authenticated attackers to upload files without proper validation.
What is the impact of CVE-2025-10647 on WordPress sites?
The impact of CVE-2025-10647 on WordPress sites includes the risk of malicious files being uploaded, which can lead to various attacks.