CVE-2015-10135
Published: 19 July 2025
Summary
CVE-2015-10135 is a critical-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Eoxia Wpshop 2. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 15.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2015-10135 is a critical vulnerability in the WPshop 2 – E-Commerce plugin for WordPress, affecting versions prior to 1.3.9.6. It stems from missing file type validation in the ajaxUpload function, enabling arbitrary file uploads to the affected site's server. The flaw is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type) and carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for complete compromise.
Unauthenticated attackers can exploit this vulnerability remotely over the network with low complexity and no user interaction required. By sending crafted requests to the ajaxUpload endpoint, they can upload arbitrary files, such as webshells, potentially leading to remote code execution on the server. This grants attackers high confidentiality, integrity, and availability impacts, allowing full control over the vulnerable WordPress site.
Advisories and references point to mitigation via patching. The WordPress plugins trac changeset 1103406 details the fix implemented in version 1.3.9.6, while the plugin's developers page on wordpress.org provides update guidance. Wordfence threat intelligence tracks the issue, and an exploit module exists in the wpsploit framework on GitHub, underscoring the need for immediate updates on affected installations.
Security practitioners should scan for vulnerable WPshop 2 instances using tools like those referenced in g0blin.co.uk advisory, prioritizing sites with outdated plugins given the public exploit availability.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2015-9394
Vulnerability details
The WPshop 2 – E-Commerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajaxUpload function in versions before 1.3.9.6. This makes it possible for unauthenticated attackers to upload arbitrary files on…
more
the affected sites server which may make remote code execution possible.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unrestricted file upload in public-facing WordPress plugin directly enables remote web shell deployment (T1100) via exploitation of the exposed application (T1190).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces validation and sanitization of file uploads, directly countering the missing file type validation in the ajaxUpload function that enables arbitrary file uploads.
Requires identification, reporting, and patching of the specific flaw in WPshop versions before 1.3.9.6, as recommended in advisories.
Deploys malicious code protection at upload entry points to detect and eradicate webshells or other dangerous files uploaded via the vulnerable endpoint.