CVE-2012-3575: Unrestricted file upload vulnerability in uploader.php in the RBX Gallery plugin 2.1 for WordPress allows remote attackers to execute arbitrary code by…

PriorityP270critical10CVSS 2.0

AVNACLAuNCCICAC

EXPLOIT

EPSS

15.83%

96.5th percentile

Unrestricted file upload vulnerability in uploader.php in the RBX Gallery plugin 2.1 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in uploads/rbxslider.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
rbx_gallery	rbx_gallery	—	—

Detection & IOCsextracted from sources · hover to see the quote

path/wp-content/plugins/rbxgallery/uploader.php↗

path/wp-content/uploads/rbxslider/↗

→Monitor for POST requests to uploader.php within the rbxgallery plugin directory containing multipart file uploads with executable extensions (e.g., .php) ↗
→Alert on any GET/POST requests to /wp-content/uploads/rbxslider/*.php, as webshells dropped via this vulnerability are accessible at that path ↗
→Use the Google dork inurl:/wp-content/plugins/rbxgallery/ to identify exposed vulnerable WordPress installations during threat hunting ↗

·The vulnerability is unauthenticated — no WordPress login is required to exploit uploader.php, meaning any remote attacker can upload a webshell without credentials ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.