CVE-2025-9112 is a vulnerability in the Doccure WordPress theme caused by insufficient validation of uploaded file types in the 'doccure_temp_file_uploader' function. Authenticated users with subscriber-level permissions or higher can exploit this to upload arbitrary files to the server. This arbitrary file upload can potentially lead to remote code execution, compromising the confidentiality, integrity, and availability of the affected system. The vulnerability affects all versions up to and including 1.5.0. The CVSS 3.1 base score is 8.8, reflecting network attack vector, low attack complexity, required privileges at the subscriber level, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official fix is currently available, and the product is not a cloud service.

Successful exploitation allows an authenticated user with subscriber-level or higher permissions to upload arbitrary files to the server hosting the Doccure theme. This can lead to remote code execution, resulting in full compromise of the affected system's confidentiality, integrity, and availability. The high CVSS score (8.8) indicates a severe impact if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level user permissions where possible and monitor for suspicious file uploads. Consider disabling or restricting the vulnerable upload functionality if feasible.