PT-2025-31978 · WordPress · Asset-Manager

Published 2025-08-05 · Updated 2025-08-07 · CVE-2012-10026

Positive Technologies (AI Summary)

CVSS v4.0

10

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Asset-Manager for Wordpress versions 2.0 and earlier

Description The Wordpress plugin Asset-Manager version 2.0 and below contains an unauthenticated arbitrary file upload vulnerability in upload.php. The endpoint does not properly validate and restrict uploaded file types, allowing remote attackers to upload malicious PHP scripts to a predictable temporary directory. Once uploaded, the attacker can execute the file via a direct HTTP GET request, resulting in remote code execution under the web server’s context.

Recommendations Versions prior to 2.0 are affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2012-10026

Affected Products

Asset-Manager

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2012-10026 · Security Note
• https://wordpress.org/plugins/asset-manager · Note
• https://exploit-db.com/exploits/18993 · Note
• https://t.me/cveNotify/131282 · Telegram Post
• https://t.me/CVEtracker/29232 · Telegram Post
• http://web.archive.org/web/20150106144832/http://opensyscom.fr:80/Actualites/wordpress-plugins-asset-manager-shell-upload-vulnerability.html · Note
• https://exploit-db.com/exploits/23652 · Note
• https://vulncheck.com/advisories/wordpress-plugin-asset-manager-php-file-upload · Note
• https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/wp_asset_manager_upload_exec.rb · Note