CVE-2012-10026

The WordPress plugin Asset-Manager version 2.0 and below contains an unauthenticated arbitrary file upload vulnerability in upload.php. The endpoint fails to properly validate and restrict uploaded file types, allowing remote attackers to upload malicious PHP scripts to a predictable temporary directory. Once uploaded, the attacker can execute the file via a direct HTTP GET request, resulting in remote code execution under the web server’s context.

• CWE-434

• http://web.archive.org/web/20150106144832/http://www.opensyscom.fr:80/Actualites/wordpress-plugins-asset-manager-shell-upload-vulnerability.html
• https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/wp_asset_manager_upload_exec.rb
• https://wordpress.org/plugins/asset-manager/
• https://www.exploit-db.com/exploits/18993
• https://www.exploit-db.com/exploits/23652
• https://www.vulncheck.com/advisories/wordpress-plugin-asset-manager-php-file-upload
• http://web.archive.org/web/20150106144832/http://www.opensyscom.fr:80/Actualites/wordpress-plugins-asset-manager-shell-upload-vulnerability.html
• https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/wp_asset_manager_upload_exec.rb
• https://www.exploit-db.com/exploits/18993
• https://www.exploit-db.com/exploits/23652

Published

Aug 5, 2025

Last Modified

Jun 16, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2012-10020The FoxyPress plugin for WordPress is vulnerable to arbitrar…9.8
• CVE-2012-10021A stack-based buffer overflow vulnerability exists in D-Link…9.8
• CVE-2012-10022Kloxo versions 6.1.12 and earlier contain two setuid root bi…8.5
• CVE-2012-10023A stack-based buffer overflow vulnerability exists in FreeFl…9.8
• CVE-2012-10024XBMC version 11.0 contains a path traversal vulnerability in…7.1
• CVE-2012-10025The WordPress plugin Advanced Custom Fields (ACF) version 3.…10
• CVE-2012-10027WP-Property plugin for WordPress up to and including version…9.3
• CVE-2012-10028Netwin SurgeFTP version 23c8 and prior contains a vulnerabil…8.6
• CVE-2012-10029Nagios XI Network Monitor prior to Graph Explorer component …8.6
• CVE-2012-1003Multiple integer overflows in Opera 11.60 and earlier allow …
• CVE-2012-10030FreeFloat FTP Server contains multiple critical design flaws…9.8
• CVE-2012-10031BlazeVideo HDTV Player Pro v6.6.0.3 is vulnerable to a stack…8.6