CVE-2012-10020
Published: 22 July 2025
Summary
CVE-2012-10020 is a critical-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Webmovementllc Foxypress. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 0.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2012-10020 is an arbitrary file upload vulnerability in the FoxyPress plugin for WordPress, affecting versions up to and including 0.4.2.1. The issue stems from missing file type validation in the uploadify.php file, enabling attackers to upload arbitrary files to the affected site's server. This flaw is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type) and carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Unauthenticated attackers can exploit this vulnerability remotely with low complexity and no user interaction or privileges required. By leveraging the flawed upload mechanism, they can place malicious files on the server, which may result in remote code execution depending on the file type and server configuration.
References point to mitigation via a patch in WordPress plugin trac changeset 555071. Additional resources include a Metasploit Framework exploit module (wp_foxypress_upload.rb) hosted on GitHub, a PacketStorm advisory, an archived SecurityFocus BID 53805, and Wordfence threat intelligence detailing the vulnerability (ID 8fbc88da-8944-433c-b94d-9604ffe13d8a).
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2012-6566
Vulnerability details
The FoxyPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the uploadify.php file in versions up to, and including, 0.4.2.1. This makes it possible for unauthenticated attackers to upload arbitrary files on…
more
the affected sites server which may make remote code execution possible.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Arbitrary file upload in public-facing WordPress plugin directly enables exploitation of web apps (T1190) and web shell deployment for RCE (T1505.003).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Information Input Validation directly enforces file type validation at upload points, preventing arbitrary file uploads due to the missing validation in uploadify.php.
Flaw Remediation requires identifying and patching the specific vulnerability in the FoxyPress plugin as provided in the referenced trac changeset 555071.
Malicious Code Protection scans and blocks execution of uploaded dangerous files at system entry points, mitigating remote code execution from arbitrary uploads.