CVE-2025-15546

Iptanus File Upload < 5.1.7 - File Overwrite via Race Condition

The Iptanus File Upload WordPress plugin before 5.1.7 does not implement proper file handling when the duplicatepolicy setting is configured to "maintain both." Due to a Time-of-Check to Time-of-Use (TOCTOU) race condition between the file existence check and the actual file write operation, an authenticated attacker can overwrite files uploaded by other users.

Affected

Iptanus File Upload

CVSS v3.1 CNA

5.4 MEDIUMCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:L

EPSS

0.16% chance of exploitation in the next 30 days, 5th percentile

Published

2026-06-14

Updated

2026-07-06

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/06e33418-1644-49a1-b012-122046604109/

References

• CVE Record
• NVD entry