CVE-2025-9314

CVE-2025-9314 is an unauthenticated arbitrary file upload flaw (CWE-434) in the SWFUpload component bundled with the Developer Tools WordPress plugin, affecting all versions through 1.1.3. An unauthenticated attacker can send crafted requests to the plugin's SWFUpload upload handler to write attacker-controlled files, such as PHP scripts, to the web server without any credentials. Because uploaded files land in web-accessible storage, this can lead to remote code execution and full site compromise, consistent with the 9.8 (critical) CVSS score. Any WordPress site running Developer Tools 1.1.3 or earlier is affected. There is currently no public proof of concept, the issue is not in CISA's KEV, and EPSS is 0.3% (22nd percentile), so no exploitation has been reported.

What to do: Update the Developer Tools plugin to the latest release as soon as a version newer than 1.1.3 is available; if no patched release exists, deactivate or remove the plugin until a fix ships. As hardening, block direct PHP execution in wp-content/uploads and other writable paths, and review those directories for unexpected PHP or web-shell files left by prior uploads. Because the flaw requires no authentication, also check web server access logs for requests to the SWFUpload upload handler on affected sites.