PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-15546 Iptanus CVE debrief

The Iptanus File Upload WordPress plugin before 5.1.7 is vulnerable to a Time-of-Check to Time-of-Use (TOCTOU) race condition. When the duplicate policy setting is configured to 'maintain both,' an authenticated attacker can overwrite files uploaded by other users due to a TOCTOU vulnerability between the file existence check and the actual file write operation.

Vendor
Iptanus
Product
File Upload WordPress plugin
CVSS
MEDIUM 5.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-14
Original CVE updated
2026-07-06
Advisory published
2026-06-14
Advisory updated
2026-07-06

Who should care

Users of the Iptanus File Upload WordPress plugin before version 5.1.7 should update to version 5.1.7 or later to mitigate this vulnerability.

Technical summary

The Iptanus File Upload WordPress plugin before 5.1.7 does not implement proper file handling when the duplicate policy setting is configured to 'maintain both.' Due to a Time-of-Check to Time-of-Use (TOCTOU) race condition between the file existence check and the actual file write operation, an authenticated attacker can overwrite files uploaded by other users.

Defensive priority

high

Recommended defensive actions

  • Update the Iptanus File Upload WordPress plugin to version 5.1.7 or later.
  • Review and adjust the duplicate policy setting to prevent unauthorized file overwrites.

Evidence notes

The CVE-2025-15546 vulnerability was reported by Wpscan.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-15546 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-15546

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-15546 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-15546

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.