CVE-2025-9113 is a critical vulnerability in the Doccure Core WordPress plugin caused by improper validation of uploaded file types in the 'doccure_temp_upload_to_media' function. This unrestricted file upload weakness (CWE-434) allows unauthenticated attackers to upload arbitrary files to the affected server, which may lead to remote code execution. The vulnerability affects all versions up to and including 1.5.3. The CVSS 3.1 base score is 9.8, reflecting its high impact on confidentiality, integrity, and availability. No patch or official fix has been documented yet, and the product is not a cloud service, so remediation depends on vendor updates.

An attacker can upload arbitrary files without authentication, which may allow execution of malicious code on the server hosting the vulnerable plugin. This compromises the confidentiality, integrity, and availability of the affected system. Given the critical CVSS score of 9.8, successful exploitation could lead to full system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to restrict or disable file uploads in the plugin if possible, and monitor for suspicious activity. Avoid exposing the vulnerable plugin on publicly accessible sites where unauthenticated users can upload files.