CVE-2012-6649 WP GPX Maps < 1.1.23 - Arbitrary File Upload

CriticalCVSS 9.8 EPSS 16.3% Public exploit

Published: 2020-01-23 23:53
Updated: 2026-06-17 02:48
Exploit status: Public exploit available

Sign in for asset impact Search another CVE

Description

WordPress WP GPX Maps Plugin 1.1.21 allows remote attackers to execute arbitrary PHP code via improper file upload.

Affected products

Product	Affected versions	Fixed in
devfarm wp gpx maps	= 1.1.21	No fix listed
wordpress wp-gpx-maps(WordPress)	< 1.1.23	1.1.23

References

53909 third-party-advisory vdb-entry
www.openwall.com mailing-list third-party-advisory
Wordfence Intelligence third-party-advisory
www.cve.org

CVSS v3.1

9.8 Critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

All scores (3)

v3.1 9.8 · nvd@nist.gov
v3.1 9.8 · wordfence
v2.0 7.5 · nvd@nist.gov

Weakness & likelihood

EPSS (exploitation probability, 30 days): 16.26% (percentile 97.0)
CWE: CWE-434 Unrestricted Upload of File with Dangerous Type

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

WordPress Plugin wp-gpx-map 1.1.21 - Arbitrary File Upload Exploit · Exploit Database (OffSec) · 2012-06-11