CVE-2015-10138
CriticalCVSS 9.8Exploitation Probability (EPSS)
High risk82th percentile - higher than 82% of all known CVEs
Summary
The Work The Flow File Upload plugin for WordPress up to version 2.5.2 allows unauthenticated attackers to upload arbitrary files due to missing file type validation in the jQuery-File-Upload-9.5.0 server and test files. This may enable remote code execution.
Risk Assessment
An unauthenticated attacker can upload a malicious file to the server, potentially leading to site compromise and arbitrary code execution.
Recommendation
Immediately update the Work The Flow File Upload plugin to the latest version that includes file type validation fixes.
Original NVD description (English source)
The Work The Flow File Upload plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the jQuery-File-Upload-9.5.0 server and test files in versions up to, and including, 2.5.2. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.