PT-2025-30127 · WordPress · Wpshop 2 – E-Commerce

Published 2025-07-19 · Updated 2025-12-16 · CVE-2015-10135

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WPshop 2 – E-Commerce plugin for WordPress versions prior to 1.3.9.6

Description The WPshop 2 – E-Commerce plugin for WordPress is susceptible to arbitrary file uploads due to the absence of file type validation within the ajaxUpload function. This allows unauthenticated attackers to upload arbitrary files to the affected server, potentially leading to remote code execution.

Recommendations Update WPshop 2 – E-Commerce plugin for WordPress to version 1.3.9.6 or later.

Exploit

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2015-10135

Affected Products

Wpshop 2 – E-Commerce

References · 9

• 🔥 https://github.com/espreto/wpsploit/blob/master/modules/exploits/unix/webapp/wp_wpshop_ecommerce_file_upload.rb · Exploit
• 🔥 https://g0blin.co.uk/g0blin-00036 · Exploit
• https://plugins.trac.wordpress.org/changeset/1103406 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2015-10135 · Security Note
• https://wordpress.org/plugins/wpshop/#developers · Note
• https://t.me/cveNotify/145972 · Telegram Post
• https://t.me/cvenotify/129541 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/32e8224d-a653-48d7-a3f4-338fc0c1dc77?source=cve · Note
• https://t.me/cvetracker/28203 · Telegram Post