CVE-2012-10026

The WordPress plugin Asset-Manager version 2.0 and below contains an unauthenticated arbitrary file upload vulnerability in upload.php. The endpoint fails to properly validate and restrict uploaded file types, allowing remote attackers to upload malicious PHP scripts to a predictable temporary directory. Once uploaded, the attacker can execute the file via a direct HTTP GET request, resulting in remote code execution under the web server’s context.

CVSS

No CVSS.

References

Link	Resource
http://web.archive.org/web/20150106144832/http://www.opensyscom.fr:80/Actualites/wordpress-plugins-asset-manager-shell-upload-vulnerability.html
https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/wp_asset_manager_upload_exec.rb
https://wordpress.org/plugins/asset-manager/
https://www.exploit-db.com/exploits/18993
https://www.exploit-db.com/exploits/23652
https://www.vulncheck.com/advisories/wordpress-plugin-asset-manager-php-file-upload
https://www.exploit-db.com/exploits/23652
https://www.exploit-db.com/exploits/18993
https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/wp_asset_manager_upload_exec.rb
http://web.archive.org/web/20150106144832/http://www.opensyscom.fr:80/Actualites/wordpress-plugins-asset-manager-shell-upload-vulnerability.html

Configurations

No configuration.

History

05 Aug 2025, 20:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-08-05 20:15

Updated : 2025-08-07 15:15

NVD link : CVE-2012-10026

Mitre link : CVE-2012-10026

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://web.archive.org/web/20150106144832/http://www.opensyscom.fr:80/Actualites/wordpress-plugins-asset-manager-shell-upload-vulnerability.html", "name": "http://web.archive.org/web/20150106144832/http://www.opensyscom.fr:80/Actualites/wordpress-plugins-asset-manager-shell-upload-vulnerability.html", "tags": [], "refsource": ""}, {"url": "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/wp_asset_manager_upload_exec.rb", "name": "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/wp_asset_manager_upload_exec.rb", "tags": [], "refsource": ""}, {"url": "https://wordpress.org/plugins/asset-manager/", "name": "https://wordpress.org/plugins/asset-manager/", "tags": [], "refsource": ""}, {"url": "https://www.exploit-db.com/exploits/18993", "name": "https://www.exploit-db.com/exploits/18993", "tags": [], "refsource": ""}, {"url": "https://www.exploit-db.com/exploits/23652", "name": "https://www.exploit-db.com/exploits/23652", "tags": [], "refsource": ""}, {"url": "https://www.vulncheck.com/advisories/wordpress-plugin-asset-manager-php-file-upload", "name": "https://www.vulncheck.com/advisories/wordpress-plugin-asset-manager-php-file-upload", "tags": [], "refsource": ""}, {"url": "https://www.exploit-db.com/exploits/23652", "name": "https://www.exploit-db.com/exploits/23652", "tags": [], "refsource": ""}, {"url": "https://www.exploit-db.com/exploits/18993", "name": "https://www.exploit-db.com/exploits/18993", "tags": [], "refsource": ""}, {"url": "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/wp_asset_manager_upload_exec.rb", "name": "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/wp_asset_manager_upload_exec.rb", "tags": [], "refsource": ""}, {"url": "http://web.archive.org/web/20150106144832/http://www.opensyscom.fr:80/Actualites/wordpress-plugins-asset-manager-shell-upload-vulnerability.html", "name": "http://web.archive.org/web/20150106144832/http://www.opensyscom.fr:80/Actualites/wordpress-plugins-asset-manager-shell-upload-vulnerability.html", "tags": [], "refsource": ""}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "The WordPress plugin Asset-Manager version 2.0 and below contains an unauthenticated arbitrary file upload vulnerability in upload.php. The endpoint fails to properly validate and restrict uploaded file types, allowing remote attackers to upload malicious PHP scripts to a predictable temporary directory. Once uploaded, the attacker can execute the file via a direct HTTP GET request, resulting in remote code execution under the web server\u2019s context."}]}, "problemtype": {"problemtype_data": [{"description": []}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2012-10026", "ASSIGNER": "disclosure@vulncheck.com"}}, "impact": {}, "publishedDate": "2025-08-05T20:15Z", "configurations": {"nodes": [], "CVE_data_version": "4.0"}, "lastModifiedDate": "2025-08-07T15:15Z"}