Vulnerability Description
WP-Property plugin for WordPress through version 1.35.0 contains an unauthenticated file upload vulnerability in the third-party `uploadify.php` script. A remote attacker can upload arbitrary PHP files to a temporary directory without authentication, leading to remote code execution.
Related Weaknesses (CWE)
References
- http://web.archive.org/web/20150103065650/http://www.opensyscom.fr:80/Actualites
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exp
- https://wordpress.org/plugins/wp-property/
- https://www.exploit-db.com/exploits/18987
- https://www.exploit-db.com/exploits/23651
- https://www.vulncheck.com/advisories/wordpress-plugin-wp-property-php-file-uploa
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exp
- https://www.exploit-db.com/exploits/18987
- https://www.exploit-db.com/exploits/23651
FAQ
What is CVE-2012-10027?
CVE-2012-10027 is a documented vulnerability. WP-Property plugin for WordPress through version 1.35.0 contains an unauthenticated file upload vulnerability in the third-party `uploadify.php` script. A remote attacker can upload arbitrary PHP file...
How severe is CVE-2012-10027?
CVSS scoring is not yet available for CVE-2012-10027. Check NVD for updates.
Is there a patch for CVE-2012-10027?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.