CVE-2025-15546: Iptanus File Upload Race Vulnerability

CVE-2025-15546 Overview

CVE-2025-15546 affects the Iptanus File Upload WordPress plugin in versions prior to 5.1.7. The plugin fails to implement proper file handling when the duplicatepolicy setting is configured to maintain both. A Time-of-Check to Time-of-Use (TOCTOU) race condition exists between the file existence check and the actual file write operation. An authenticated attacker can exploit this race window to overwrite files uploaded by other users on the same WordPress site.

Critical Impact
Authenticated users can overwrite arbitrary files uploaded by other users, leading to data integrity loss and potential content tampering on WordPress installations using the Iptanus File Upload plugin.

Affected Products

Iptanus File Upload WordPress plugin versions prior to 5.1.7
WordPress installations with the duplicatepolicy setting configured to maintain both
Multi-user WordPress sites permitting authenticated file uploads through the plugin

Discovery Timeline

2026-06-14 - CVE-2025-15546 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-15546

Vulnerability Analysis

The vulnerability is a Time-of-Check to Time-of-Use (TOCTOU) race condition in the Iptanus File Upload plugin. When the duplicatepolicy configuration is set to maintain both, the plugin checks whether a target filename already exists in the upload destination. If the file does not exist, the plugin proceeds to write the uploaded content using that name. If a file with the same name exists, the plugin would typically generate a unique filename to preserve both copies.

The gap between the existence check and the file write operation creates an exploitable window. An authenticated attacker can submit concurrent upload requests that pass the existence check before any of them complete the write operation. The result is that a later write overwrites the file produced by an earlier write, allowing one user's upload to replace another user's content.

Root Cause

The root cause is the absence of atomic file creation semantics in the upload handler. The plugin performs the duplicate-filename check as a non-atomic operation relative to the file write. There is no file system lock, no use of O_EXCL open semantics, and no synchronization primitive guarding the critical section. Concurrent requests can race past the check and converge on the same destination path.

Attack Vector

Exploitation requires authentication and access to the file upload functionality. The attacker triggers concurrent upload requests targeting filenames that another user is uploading or may upload. By winning the race between check and write, the attacker's content replaces the legitimate file. The vulnerability does not enable arbitrary code execution on its own, but it does compromise file integrity for content uploaded by other authenticated users.

The attack mechanism is described in the WPScan Vulnerability Details advisory. No verified public exploit code is available at this time.

Detection Methods for CVE-2025-15546

Indicators of Compromise

Unexpected modification timestamps on files within the WordPress uploads directory associated with the Iptanus File Upload plugin
Multiple near-simultaneous POST requests from the same authenticated user targeting the plugin's upload endpoint with identical or colliding filenames
File content mismatches between the user who originally uploaded a file and the current file contents

Detection Strategies

Audit web server access logs for bursts of concurrent upload requests to the Iptanus File Upload endpoint from a single authenticated session
Monitor file integrity in the WordPress uploads directory using hash comparisons against last-known-good baselines
Correlate WordPress user activity logs with uploaded file ownership metadata to surface ownership-content mismatches

Monitoring Recommendations

Enable verbose WordPress audit logging for all authenticated upload actions, including originating user, filename, and timestamp
Alert on repeated upload attempts targeting the same filename within short time windows from one or more user accounts
Track plugin version state across WordPress installations to identify hosts still running versions prior to 5.1.7

How to Mitigate CVE-2025-15546

Immediate Actions Required

Upgrade the Iptanus File Upload WordPress plugin to version 5.1.7 or later on all affected installations
Review the WordPress uploads directory for unexpected file modifications and restore any tampered content from backups
Restrict the set of authenticated user roles permitted to perform file uploads through the plugin

Patch Information

The vendor has addressed the issue in Iptanus File Upload version 5.1.7. Administrators should update through the WordPress plugin management interface or apply the update manually. Refer to the WPScan Vulnerability Details for advisory information.

Workarounds

Change the duplicatepolicy setting away from maintain both to a value that does not trigger the vulnerable code path until the patch can be applied
Temporarily disable the Iptanus File Upload plugin on multi-user sites where untrusted authenticated users have upload access
Apply web application firewall rules that rate-limit concurrent uploads from a single authenticated session to the plugin endpoint

bash

# Configuration example: update the plugin via WP-CLI
wp plugin update iptanus-wordpress-file-upload --version=5.1.7
wp plugin list --name=iptanus-wordpress-file-upload --fields=name,status,version