CVE-2015-10144
Published: 25 July 2025
Summary
CVE-2015-10144 is a high-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in I13Websolution Thumbnail Carousel Slider. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 20.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-11 (User-installed Software) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2015-10144 affects the Responsive Thumbnail Slider plugin for WordPress in versions up to 1.0.1. The vulnerability stems from missing file type sanitization in the image uploader, enabling arbitrary file uploads. This flaw, classified under CWE-434 (Unrestricted Upload of File with Dangerous Type), carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact.
Authenticated attackers with subscriber-level access or higher can exploit this vulnerability over the network with low complexity and no user interaction required. By leveraging a double extension technique in file uploads, they can place arbitrary files on the affected server's filesystem, which may lead to remote code execution depending on server configuration and file types permitted.
Advisories and references, including those from Wordfence, Acunetix, Exploit-DB (exploit 37998), and a Metasploit module (wp_responsive_thumbnail_slider_upload), document the issue and provide details on exploitation. Mitigation involves updating to a patched version beyond 1.0.1 or disabling the plugin, as outlined in these sources.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2015-9403
Vulnerability details
The Responsive Thumbnail Slider plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type sanitization in the via the image uploader in versions up to 1.0.1. This makes it possible for authenticated attackers, with subscriber-level access…
more
and above, to upload arbitrary files on the affected sites server using a double extension which may make remote code execution possible.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Arbitrary file upload in public-facing WordPress plugin directly enables exploitation of the web application (T1190) and deployment of web shells for RCE (T1100).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the missing file type sanitization by enforcing input validation at the image uploader interface to block arbitrary file uploads.
Requires identification, reporting, and timely remediation of the plugin flaw enabling unrestricted file uploads with dangerous types.
Prohibits or approves user-installed software like the vulnerable Responsive Thumbnail Slider plugin, preventing deployment of components with arbitrary file upload flaws.