The Doppler Forms WordPress plugin through 2.5.1 registers an AJAX action install_extension without verifying user capabilities or using a nonce. As a result, any authenticated user — including those with the Subscriber role — can install and activate additional Doppler Forms WordPress plugin through 2.5.1 (limited to those whitelisted by the main Doppler Forms WordPress plugin through 2.5.1).
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Doppler Form Plugin | — | Update doppler-form plugin to version 2.6.0, or a newer patched version | Nov 5, 2025 | Oct 8, 2025 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub