CVE-2025-9112
Published: 08 September 2025
Summary
CVE-2025-9112 is a high-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Themeforest (inferred from references). Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 36.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-9112 is an arbitrary file upload vulnerability in the Doccure theme for WordPress, stemming from incorrect file type validation in the 'doccure_temp_file_uploader' function. It affects all versions up to and including 1.5.0. The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-434 (Unrestricted Upload of File with Dangerous Type).
Authenticated attackers with subscriber-level permissions or higher can exploit this issue over the network with low complexity and no user interaction required. By uploading arbitrary files to the server's filesystem, they may achieve remote code execution, granting high levels of confidentiality, integrity, and availability impact.
Advisories and further details on mitigation, including potential patches or updates, are documented by Wordfence at https://www.wordfence.com/threat-intel/vulnerabilities/id/2f38498d-0560-4935-b1f5-1fdb62f49a5b?source=cve and on the Doccure theme's ThemeForest page at https://themeforest.net/item/doccure-medical-wordpress-theme/34329202.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-27168
Vulnerability details
The Doccure theme for WordPress is vulnerable to arbitrary file uploads due to incorrect file type validation in the 'doccure_temp_file_uploader' function in all versions up to, and including, 1.5.0. This makes it possible for authenticated attackers, with subscriber-level and above…
more
permissions, to upload arbitrary files on the affected site's server which may make remote code execution possible.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Arbitrary file upload flaw in public-facing WordPress component directly enables web shell deployment for RCE.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Flaw remediation directly patches the incorrect file type validation in the Doccure theme's 'doccure_temp_file_uploader' function, eliminating the arbitrary file upload vulnerability.
Information input validation enforces proper checking of uploaded file types and contents, comprehensively addressing the CWE-434 unrestricted upload of dangerous files.
Information input restrictions limit the types of files that can be uploaded via the vulnerable function, preventing exploitation with arbitrary dangerous files.