CVE-2012-10027 WordPress Plugin WP-Property <= 1.35.0 PHP File Upload
CriticalCVSS 9.3
EPSS 2.1%
Framework module
- Published
- Updated
- Exploit status
- Public exploit available
Description
WP-Property plugin for WordPress up to and including version 1.35.0 contains an unauthenticated file upload vulnerability in the third-party uploadify.php script. A remote attacker can upload arbitrary PHP files to a temporary directory without authentication, leading to remote code execution.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| WP-Property WordPress Plugin | <= 1.35.0 | No fix listed |
| wordpress wp-property(WordPress) | < 1.35.1 | 1.35.1 |
References
- wordpress.org product
- raw.githubusercontent.com exploit
- www.exploit-db.com exploit
- www.exploit-db.com exploit
- web.archive.org exploit technical-description
- www.vulncheck.com third-party-advisory
- Wordfence Intelligence third-party-advisory
- www.cve.org