Executive brief
The Developer Tools WordPress plugin contains a vulnerable file upload component (SWFUpload) that does not require authentication. An attacker can upload arbitrary files, including malicious PHP scripts, directly to the WordPress uploads directory, leading to remote code execution and complete website compromise.
Technical details
The vulnerability is an unauthenticated arbitrary file upload in the bundled SWFUpload component located at /wp-content/plugins/developer-tools/libs/swfupload/upload.php. The upload.php script fails to properly validate or restrict file types and does not enforce authentication checks, allowing an unauthenticated attacker to upload files directly via POST requests with custom UPLOADDIR parameter values. By specifying a target directory such as ../../../../uploads/2025/08, an attacker can traverse directories and place PHP shells or other malicious files in web-accessible locations. Uploaded files are immediately executable, enabling remote code execution. No patch is currently available for versions through 1.1.3.
Affected products
- WordPress Developer Tools through 1.1.3
Timeline
- 2025-08-21: disclosed
- 2026-09-02: advisory: Published on NVD