The Developer Tools WordPress plugin through 1.1.3 contains an unauthenticated arbitrary file upload vulnerability in the bundled SWFUpload component

CVE-2025-9314 affects the Developer Tools WordPress plugin through version 1.1.3, which bundles a vulnerable SWFUpload component. The vulnerability allows unauthenticated attackers to upload arbitrary files to the affected server. This type of vulnerability is critical as it can lead to remote code execution, full site compromise, and server takeover without requiring any authentication. The flaw resides in the bundled third-party SWFUpload library, a common pattern of supply chain risk within WordPress plugins. No authentication is required to exploit this vulnerability, making it accessible to any remote attacker. WordPress site administrators running this plugin should update or remove the plugin immediately. The vulnerability has been documented by both NVD/NIST and WPScan.