CVE-2012-10026: WordPress Plugin Asset-Manager <= 2.0 PHP File Upload
The WordPress plugin Asset-Manager version 2.0 and below contains an unauthenticated arbitrary file upload vulnerability in upload.php. The endpoint fails to properly validate and restrict uploaded file types, allowing remote attackers to upload malicious PHP scripts to a predictable temporary directory. Once uploaded, the attacker can execute the file via a direct HTTP GET request, resulting in remote code execution under the web server’s context.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress plugin Asset-Managerto a version that resolves this vulnerability.Fixed in 2.0 - Compensating control
Apply compensating control by preventing direct HTTP GET execution of uploaded files (e.g., restrict/deny access to the predictable temporary upload directory where malicious PHP scripts could be placed).
Event History
Frequently Asked Questions
What is the severity of CVE-2012-10026?
CVE-2012-10026 has a critical severity rating due to its potential for remote code execution through arbitrary file uploads.
How do I fix CVE-2012-10026?
To mitigate CVE-2012-10026, update the Asset-Manager plugin to version 2.1 or higher where the vulnerability is patched.
What versions are affected by CVE-2012-10026?
CVE-2012-10026 affects Asset-Manager version 2.0 and below.
Can CVE-2012-10026 be exploited remotely?
Yes, CVE-2012-10026 can be exploited remotely by attackers to upload malicious files.
What is the nature of the vulnerability presented in CVE-2012-10026?
CVE-2012-10026 is an unauthenticated arbitrary file upload vulnerability in the upload.php endpoint.