CVE-2015-10135

published 2025-07-19

CVE-2015-10135: The WPshop 2 – E-Commerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajaxUpload function in…

Priority P2 76 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

EXPLOIT

The WPshop 2 – E-Commerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajaxUpload function in versions before 1.3.9.6. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
eoxia	wpshop_2	< 1.3.9.6	1.3.9.6
eoxia	wpshop_2_e-commerce	< 1.3.9.6	1.3.9.6

Detection & IOCs extracted from sources · hover to see the quote

url /wp-content/plugins/wpshop/includes/ajax.php↗

version WPshop 2 – E-Commerce versions before 1.3.9.6↗

• → Monitor for unauthenticated POST requests to the ajaxUpload function endpoint in the WPshop plugin, particularly those uploading PHP or executable file types. ↗
• → Detect exploitation attempts targeting WordPress WPshop eCommerce plugin versions 1.3.3.3 through 1.3.9.5, which allow arbitrary PHP file upload and remote code execution. ↗

• · The Metasploit module was tested on a specific environment; exploitation behavior may vary outside this configuration. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-434