CVE-2025-9544: Unknown Doppler Forms

Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days.

The Doppler Forms WordPress plugin through 2.5.1 registers an AJAX action install_extension without verifying user capabilities or using a nonce. As a result, any authenticated user — including those with the Subscriber role — can install and activate additional Doppler Forms WordPress plugin through 2.5.1 (limited to those whitelisted by the main Doppler Forms WordPress plugin through 2.5.1).

Affected products

• Unknown Doppler Forms: up to and including 2.5.1

Published 2025-10-29. Last modified 2026-10-08.