CVE-2015-10135

CRITICAL

9.8

CVSS Severity Score

EPSS Score0.1670%

EPSS Percentile0.93th

Published2025年7月19日

Last Modified2025年12月16日

Vulnerability Description

The WPshop 2 – E-Commerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajaxUpload function in versions before 1.3.9.6. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.

Affected Platforms (CPE)

📦

Eoxia

Wpshop 2

< 1.3.9.6

References & Advisories

🔗 https://g0blin.co.uk/g0blin-00036/

🔗 https://github.com/espreto/wpsploit/blob/master/modules/exploits/unix/webapp/wp_wpshop_ecommerce_file_upload.rb

🔗 https://plugins.trac.wordpress.org/changeset/1103406

🔗 https://wordpress.org/plugins/wpshop/#developers

🔗 https://www.wordfence.com/threat-intel/vulnerabilities/id/32e8224d-a653-48d7-a3f4-338fc0c1dc77?source=cve

Vulnerability Description

Affected Platforms (CPE)

Wpshop 2

References & Advisories

関連する脆弱性情報