PT-2025-30124 · WordPress · Front End Editor

Published 2025-07-19 · Updated 2025-12-19 · CVE-2012-10019

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Front End Editor plugin for WordPress versions prior to 2.3

Description The Front End Editor plugin for WordPress is susceptible to arbitrary file uploads due to missing file type validation via the upload.php file. This allows unauthenticated attackers to upload arbitrary files to the affected server, potentially leading to remote code execution.

Recommendations Update the Front End Editor plugin to version 2.3 or later.

Exploit

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2012-10019

Affected Products

Front End Editor

References · 9

• 🔥 https://packetstormsecurity.com/files/132303 · Exploit
• 🔥 https://web.archive.org/web/20120712205339/https%3A//www.opensyscom.fr/Actualites/wordpress-plugins-front-end-editor-arbitrary-file-upload-vulnerability.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-10019 · Security Note
• https://cybersecurity-help.cz/vdb/SB2012070701 · Note
• https://t.me/cvetracker/28200 · Telegram Post
• https://t.me/cveNotify/146383 · Telegram Post
• https://t.me/cvenotify/129538 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/f271c2e7-9d58-4dea-95d3-3ffc4ec7c3b2?source=cve · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=600233%40front-end-editor&old=569105%40front-end-editor&sfp_email=&sfph_mail= · Note