The Doppler Forms plugin registers an AJAX action called install_extension without checking the user’s capabilities or validating a nonce. As a result, any authenticated user can trigger the action and install or activate additional plugins that are whitelisted by the plugin itself. This flaw effectively allows privilege escalation from a Subscriber role to the ability to modify the site’s functionality and potentially introduce malicious code.

Any WordPress site running Doppler Forms version 2.5.1 or earlier is vulnerable. The exploit is limited to the plugin’s extension list, but installing even a benign extension gives an attacker a foothold for further compromise.

The CVSS score of 6.5 indicates moderate severity, yet the EPSS score of less than 1% suggests a very low chance of exploitation in the wild. The flaw is not yet listed in the CISA KEV catalog. Because the attack vector requires an authenticated user with at least Subscriber level access, the risk is confined to sites with many low‑privilege accounts. However, once an extension is installed, the attacker could gain elevated privileges if the extension contains a vulnerability or malicious payload.