PT-2026-3315 · WordPress · Omni-Secure-Files
CVE-2012-10064
·
Published
2012-06-07
·
Updated
2026-01-16
CVSS v4.0
9.3
Critical
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
Omni Secure Files versions prior to 0.1.14
Description
An arbitrary file upload issue exists due to missing file type validation. Unauthenticated attackers can upload controlled files to the plugin upload directory via the endpoint '/wp-content/plugins/omni-secure-files/plupload/examples/upload.php'. This can lead to remote code execution if an executable file is uploaded and subsequently accessed.
Recommendations
Update to version 0.1.14 or later.
Restrict access to the '/wp-content/plugins/omni-secure-files/plupload/examples/upload.php' endpoint as a temporary mitigation.
Fix
RCE
Unrestricted File Upload
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Omni-Secure-Files