CVE-2015-10138
The Work The Flow File Upload plugin for WordPress (CWE-434) allows unauthenticated attackers to upload arbitrary files due to missing file type validation in versions up to 2.5.2, potentially enabling remote code execution. No official fix is documented in the provided sources.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Users of the 'lyntonreed work_the_flow_file_upload' WordPress plugin (versions up to 2.5.2)
Real-world impact
Unauthenticated attackers could upload malicious files to the server, potentially leading to remote code execution.
Why this severity
CVSS 9.8 (critical): High confidence in exploitation, high impact on confidentiality, integrity, and availability.
What to do about it
- ›Avoid using the Work The Flow File Upload plugin until a fix is available.
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
NVD description
Timeline
- Jul 19, 2025 · Jul 19, 2025PublishedDisclosed and added to the National Vulnerability Database.
- Jul 27, 2026 · 9d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- packetstormsecurity.com/files/131294/exploit
- packetstormsecurity.com/files/131512/exploit
- plugins.trac.wordpress.org/changesetpatch
- plugins.trac.wordpress.org/changesetpatch
- wpscan.com/vulnerability/a49a81a9-3d4b…third party advisory
- acunetix.com/vulnerabilities/web/wordpre…third party advisory
- homelab.it/index.php/2015/04/04/wordpr…exploitthird party advisory
- rapid7.com/db/modules/exploit/unix/web…third party advisory
- wordfence.com/threat-intel/vulnerabilitie…third party advisory