CVE-2025-10754: DocoDoco Store Locator RCE Vulnerability

CVE-2025-10754 Overview

CVE-2025-10754 affects the DocoDoco Store Locator plugin for WordPress in all versions up to and including 1.0.1. The plugin fails to validate file types in its ZIP upload functionality, allowing authenticated users with Editor-level access or higher to upload arbitrary files to the web server. Successful exploitation can lead to remote code execution on the affected site. The flaw is tracked under CWE-434: Unrestricted Upload of File with Dangerous Type.

Critical Impact
Authenticated attackers with Editor privileges can upload arbitrary files and achieve remote code execution on the underlying WordPress host.

Affected Products

DocoDoco Store Locator plugin for WordPress (all versions ≤ 1.0.1)
WordPress sites with Editor-level or higher accounts exposed
Web servers hosting vulnerable installations of the plugin

Discovery Timeline

2025-10-15 - CVE-2025-10754 published to the National Vulnerability Database
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-10754

Vulnerability Analysis

The DocoDoco Store Locator plugin exposes administrative ZIP upload functionality through the includes/Admin/ZIP.php handler. The upload routine processes user-supplied archives without validating the MIME type or extension of files contained within. An authenticated attacker with Editor privileges can submit a crafted upload that places executable PHP content into a web-accessible location. Once written to disk, the attacker can request the file directly to execute arbitrary code under the web server account.

The issue maps to CWE-434, Unrestricted Upload of File with Dangerous Type. The plugin trusts the contents of the supplied archive and relies on no allowlist of permitted extensions. Because the upload handler runs in an authenticated administrative context, the resulting files inherit write permissions sufficient to land inside the WordPress content tree.

Root Cause

The root cause is missing file type validation in the ZIP upload functionality at lines 187 and 275 of ZIP.php. The code accepts archive content and writes it to disk without inspecting extensions, MIME types, or magic bytes against an allowlist. Reference the WordPress plugin source at line 187 and line 275 for the affected upload paths.

Attack Vector

The attack vector is network-based and requires authenticated access at Editor level or above. An attacker logs in with valid Editor credentials, navigates to the plugin's ZIP upload feature, and submits an archive containing a PHP payload disguised within otherwise legitimate files. After the server extracts and writes the payload to a web-accessible directory, the attacker requests the URL to trigger execution. See the Wordfence vulnerability analysis for additional context.

Detection Methods for CVE-2025-10754

Indicators of Compromise

Unexpected .php, .phtml, or .phar files appearing inside the DocoDoco Store Locator plugin directory or wp-content/uploads/
Web server access logs showing POST requests to the plugin's ZIP upload endpoint followed by GET requests to newly created files
New or modified scheduled tasks, WordPress users, or admin options created shortly after a ZIP upload event
Outbound network connections from the PHP worker to unfamiliar IP addresses or domains

Detection Strategies

Audit the WordPress filesystem for executable files inside the plugin's upload paths referenced in includes/Admin/ZIP.php
Correlate Editor-level authentication events with subsequent file write activity on the web root
Inspect uploaded archives at the WAF or reverse proxy layer for embedded PHP content prior to disk write

Monitoring Recommendations

Enable WordPress audit logging to capture plugin upload actions and user role changes
Monitor web server file integrity for wp-content and plugin directories
Alert on HTTP requests to files within wp-content/plugins/docodoco-store-locator/ that return PHP execution responses

How to Mitigate CVE-2025-10754

Immediate Actions Required

Disable or uninstall the DocoDoco Store Locator plugin until a patched release is published by the vendor
Review and rotate credentials for all WordPress accounts with Editor privileges or higher
Scan the web root for unauthorized PHP files and remove any artifacts left by exploitation attempts
Restrict Editor-level account assignment to vetted users and enforce multi-factor authentication

Patch Information

No fixed version is identified in the available references at the time of publication. All versions of the DocoDoco Store Locator plugin through 1.0.1 remain vulnerable. Track the Wordfence advisory and the official WordPress plugin repository for an updated release.

Workarounds

Remove or deactivate the plugin from the WordPress installation
Block access to the plugin's admin upload endpoints using a web application firewall rule
Set the WordPress uploads directory to deny PHP execution via web server configuration

bash

# Apache: deny PHP execution under wp-content/uploads
<Directory "/var/www/html/wp-content/uploads">
    <FilesMatch "\.(php|phtml|phar)$">
        Require all denied
    </FilesMatch>
</Directory>

# Nginx: deny PHP execution under wp-content/uploads
location ~* /wp-content/uploads/.*\.(php|phtml|phar)$ {
    deny all;
    return 403;
}