PT-2025-51681 · WordPress · Wp-Responsive-Thumbnail-Slider

Published 2025-07-25 · Updated 2025-12-16 · CVE-2015-10144

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Responsive Thumbnail Slider plugin for WordPress versions prior to 1.0.1

Description The software is susceptible to arbitrary file uploads because of inadequate file type validation within the image uploader. Attackers with subscriber-level access or higher can upload arbitrary files to the server using a double extension technique, potentially leading to remote code execution.

Recommendations Update the Responsive Thumbnail Slider plugin to a version newer than 1.0.1.

Exploit

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2015-10144

Affected Products

Wp-Responsive-Thumbnail-Slider

References · 7

• 🔥 https://exploit-db.com/exploits/37998 · Exploit
• 🔥 https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/wp_responsive_thumbnail_slider_upload.rb · Exploit
• 🔥 https://cxsecurity.com/issue/WLB-2015080170 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-10144 · Security Note
• https://acunetix.com/vulnerabilities/web/wordpress-plugin-thumbnail-carousel-slider-arbitrary-file-upload-1-0 · Note
• https://t.me/cveNotify/145942 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/6c396ae6-d34c-4554-b670-28868dc136a5?source=cve · Note