CVE-2025-9544 – Doppler Forms

CVE ID : CVE-2025-9544

Published : Oct. 29, 2025, 6:15 a.m. | 1 hour, 7 minutes ago

Description : The Doppler Forms WordPress plugin through 2.5.1 registers an AJAX action install_extension without verifying user capabilities or using a nonce. As a result, any authenticated user — including those with the Subscriber role — can install and activate additional Doppler Forms WordPress plugin through 2.5.1 (limited to those whitelisted by the main Doppler Forms WordPress plugin through 2.5.1).

Severity: 0.0 | NA

Visit the link for more details, such as CVSS details, affected products, timeline, and more…