CVE-2012-1125
Unrestricted file upload vulnerability in uploadify/scripts/uploadify.php in the Kish Guest Posting plugin before 1.2 for WordPress allows remote attackers to execute arbitrary code by uploading a file with a PHP extension, then accessing it via a direct request to the file in the directory specified by the folder parameter.
- EPSS
- 12% chance of exploitation in the next 30 days; higher than 96% of CVEs (scores of 2026-10-31)
- Published
- Modified
- Record from
- the NVD, synced
Affected
- kishore_asokan:kish_guest_posting_plugin
References
- http://archives.neohapsis.com/archives/bugtraq/2012-01/0145.html
- http://plugins.svn.wordpress.org/kish-guest-posting/trunk/readme.txt
- http://plugins.trac.wordpress.org/changeset/403694/kish-guest-posting/trunk/uploadify/scripts/uploadify.php
- http://secunia.com/advisories/47688
- http://www.exploit-db.com/exploits/18412