CVE-2012-10020

CriticalPublic PoC

Published: 22 July 2025

Published

22 July 2025

Modified

16 December 2025

KEV Added

—

Patch

—

CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.6885 98.6th percentile

Risk Priority 61 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2012-10020 is a critical-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Webmovementllc Foxypress. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 1.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Information Input Validation directly enforces file type validation at upload points, preventing arbitrary file uploads due to the missing validation in uploadify.php.

SI-2 Flaw Remediation good match

prevent

Flaw Remediation requires identifying and patching the specific vulnerability in the FoxyPress plugin as provided in the referenced trac changeset 555071.

SI-3 Malicious Code Protection partial match

preventdetect

Malicious Code Protection scans and blocks execution of uploaded dangerous files at system entry points, mitigating remote code execution from arbitrary uploads.

NVD Description

The FoxyPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the uploadify.php file in versions up to, and including, 0.4.2.1. This makes it possible for unauthenticated attackers to upload arbitrary files on…

the affected sites server which may make remote code execution possible.

Deeper analysisAI

CVE-2012-10020 is an arbitrary file upload vulnerability in the FoxyPress plugin for WordPress, affecting versions up to and including 0.4.2.1. The issue stems from missing file type validation in the uploadify.php file, enabling attackers to upload arbitrary files to the affected site's server. This flaw is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type) and carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Unauthenticated attackers can exploit this vulnerability remotely with low complexity and no user interaction or privileges required. By leveraging the flawed upload mechanism, they can place malicious files on the server, which may result in remote code execution depending on the file type and server configuration.

References point to mitigation via a patch in WordPress plugin trac changeset 555071. Additional resources include a Metasploit Framework exploit module (wp_foxypress_upload.rb) hosted on GitHub, a PacketStorm advisory, an archived SecurityFocus BID 53805, and Wordfence threat intelligence detailing the vulnerability (ID 8fbc88da-8944-433c-b94d-9604ffe13d8a).