PT-2025-30373 · WordPress · Website Contact Form With File Upload

Published 2025-07-22 · Updated 2025-12-16 · CVE-2015-10137

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Website Contact Form With File Upload for WordPress versions up to 1.3.4

Description The Website Contact Form With File Upload plugin for WordPress is susceptible to arbitrary file uploads due to insufficient file type validation within the upload file() function. This allows unauthenticated attackers to upload arbitrary files to the affected site's server, potentially enabling remote code execution.

Recommendations Update Website Contact Form With File Upload for WordPress to a version later than 1.3.4.

Exploit

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2015-10137

Affected Products

Website Contact Form With File Upload

References · 10

• 🔥 https://packetstormsecurity.com/files/131413 · Exploit
• 🔥 https://homelab.it/index.php/2015/04/12/wordpress-n-media-website-contact-form-shell-upload · Exploit
• 🔥 https://packetstormsecurity.com/files/131514 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-10137 · Security Note
• https://plugins.trac.wordpress.org/browser/website-contact-form-with-file-upload/trunk/readme.txt · Note
• https://t.me/cveNotify/145940 · Telegram Post
• https://plugins.trac.wordpress.org/browser/website-contact-form-with-file-upload/trunk/readme.txt#L147 · Note
• https://t.me/cvenotify/129765 · Telegram Post
• https://acunetix.com/vulnerabilities/web/wordpress-plugin-n-media-website-contact-form-with-file-upload-arbitrary-file-upload-1-3-4 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/8395e0c4-3feb-4551-9f2f-7b80cd187eca?source=cve · Note