CVE-2015-10135

CriticalPublic PoC

Published: 19 July 2025

Published

19 July 2025

Modified

16 December 2025

KEV Added

—

Patch

—

CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.6522 98.5th percentile

Risk Priority 59 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2015-10135 is a critical-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Eoxia Wpshop 2. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 1.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Enforces validation and sanitization of file uploads, directly countering the missing file type validation in the ajaxUpload function that enables arbitrary file uploads.

SI-2 Flaw Remediation good match

prevent

Requires identification, reporting, and patching of the specific flaw in WPshop versions before 1.3.9.6, as recommended in advisories.

SI-3 Malicious Code Protection partial match

preventdetect

Deploys malicious code protection at upload entry points to detect and eradicate webshells or other dangerous files uploaded via the vulnerable endpoint.

NVD Description

The WPshop 2 – E-Commerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajaxUpload function in versions before 1.3.9.6. This makes it possible for unauthenticated attackers to upload arbitrary files on…

the affected sites server which may make remote code execution possible.

Deeper analysisAI

CVE-2015-10135 is a critical vulnerability in the WPshop 2 – E-Commerce plugin for WordPress, affecting versions prior to 1.3.9.6. It stems from missing file type validation in the ajaxUpload function, enabling arbitrary file uploads to the affected site's server. The flaw is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type) and carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for complete compromise.

Unauthenticated attackers can exploit this vulnerability remotely over the network with low complexity and no user interaction required. By sending crafted requests to the ajaxUpload endpoint, they can upload arbitrary files, such as webshells, potentially leading to remote code execution on the server. This grants attackers high confidentiality, integrity, and availability impacts, allowing full control over the vulnerable WordPress site.

Advisories and references point to mitigation via patching. The WordPress plugins trac changeset 1103406 details the fix implemented in version 1.3.9.6, while the plugin's developers page on wordpress.org provides update guidance. Wordfence threat intelligence tracks the issue, and an exploit module exists in the wpsploit framework on GitHub, underscoring the need for immediate updates on affected installations.

Security practitioners should scan for vulnerable WPshop 2 instances using tools like those referenced in g0blin.co.uk advisory, prioritizing sites with outdated plugins given the public exploit availability.