CVE-2012-10026

published 2025-08-05

CVE-2012-10026: The WordPress plugin Asset-Manager version 2.0 and below contains an unauthenticated arbitrary file upload vulnerability in upload.php. The endpoint fails to…

Priority P2 76 critical 10 CVSS 4.0

AV N AC L AT N PR N UI N VC H VI H VA H SC H SI H SA H E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

EXPLOIT

The WordPress plugin Asset-Manager version 2.0 and below contains an unauthenticated arbitrary file upload vulnerability in upload.php. The endpoint fails to properly validate and restrict uploaded file types, allowing remote attackers to upload malicious PHP scripts to a predictable temporary directory. Once uploaded, the attacker can execute the file via a direct HTTP GET request, resulting in remote code execution under the web server’s context.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
jkriddle	asset-manager	<= 2.0	—

Detection & IOCs extracted from sources · hover to see the quote

path upload.php↗

• → Monitor for unauthenticated HTTP POST requests to the Asset-Manager plugin's upload.php endpoint, particularly those uploading files with PHP extensions. ↗
• → Alert on PHP script files appearing in the plugin's temporary upload directory, as the upload destination is predictable and does not restrict file types. ↗

• · The vulnerability only affects Asset-Manager plugin version 2.0 and below; ensure version scoping when deploying detections to avoid false positives on patched installations. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-434