Cyber Resilience

CVE-2025-9113

Critical

Published: 08 September 2025

Published
08 September 2025
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0105 78.0th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-9113 is a critical-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Themeforest (inferred from references). Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 22.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

The Doccure Core plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'doccure_temp_upload_to_media' function. The flaw affects all versions through 1.5.3 and is tracked as CWE-434, carrying a CVSS 3.1 score of 9.8.

Unauthenticated attackers can exploit the issue over the network to upload arbitrary files to the server, which may enable remote code execution on the affected WordPress site.

Public references point to the vendor's ThemeForest listing for the related Doccure medical theme and a Wordfence threat intelligence entry, though no specific patch or mitigation guidance is detailed in the available information. The associated EPSS score remains flat at 0.0105 with no material increase observed after disclosure.

EU & UK References

Vulnerability details

The Doccure Core plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'doccure_temp_upload_to_media' function in all versions up to, and including, 1.5.3. This makes it possible for unauthenticated attackers to upload arbitrary…

more

files on the affected site's server which may make remote code execution possible.

CWE(s)
CWE-434

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1505.003 Web Shell Persistence
Adversaries may backdoor web servers with web shells to establish persistent access to systems.
attack.mitre.org →
Why these techniques?

Arbitrary file upload in public-facing WordPress plugin enables remote unauthenticated exploitation (T1190) and direct deployment of web shells for RCE (T1505.003).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2025-46384Shared CWE-434
CVE-2025-13516Shared CWE-434
CVE-2024-13011Shared CWE-434
CVE-2025-8323Shared CWE-434
CVE-2025-21624Shared CWE-434
CVE-2026-35164Shared CWE-434
CVE-2026-2097Shared CWE-434
CVE-2025-12154Shared CWE-434
CVE-2026-42748Shared CWE-434
CVE-2025-32957Shared CWE-434

Affected Assets

Themeforest
—
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Remediating the specific flaw in the Doccure Core plugin's 'doccure_temp_upload_to_media' function by patching to a non-vulnerable version directly eliminates the arbitrary file upload vulnerability.

SI-10 Information Input Validation good match
prevent

Enforcing information input validation for file types and contents at upload points comprehensively addresses the missing file type validation that enables arbitrary file uploads.

SI-9 Information Input Restrictions good match
prevent

Restricting file types, extensions, and sizes at system input boundaries prevents unauthenticated attackers from uploading dangerous files leading to remote code execution.

References