CVSS 3.1
5.4 mediumCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:LCVE-2025-15546
Medium (5.4). EPSS 0.2% chance of exploitation in the next 30 days.
The Iptanus File Upload WordPress plugin before 5.1.7 does not implement proper file handling when the duplicatepolicy setting is configured to "maintain both." Due to a Time-of-Check to Time-of-Use (TOCTOU) race condition between the file existence check and the actual file write operation, an authenticated attacker can overwrite files uploaded by other users.
Severity
- EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 4% of CVEs (scores of 2026-10-31)
- CWE
- CWE-362
- Published
- Modified
- Record from
- the NVD, synced