CVE-2012-10026

🗓️ 05 Aug 2025 20:06:23Reported by VulnCheckType

cve🔗 web.nvd.nist.gov👁 25 Views🌐 WEB

Vulnerability in WordPress Asset-Manager allows arbitrary PHP file upload leading to remote code execution

Reporter	Title	Published	Views	Family All 11
ATTACKERKB	CVE-2012-10026	5 Aug 202520:06	–	attackerkb
Circl	CVE-2012-10026	29 May 201815:50	–	circl
CNNVD	WordPress plugin Asset-Manager 安全漏洞	5 Aug 202500:00	–	cnnvd
Cvelist	CVE-2012-10026 WordPress Plugin Asset-Manager <= 2.0 PHP File Upload	5 Aug 202520:06	–	cvelist
EUVD	EUVD-2012-6570	7 Oct 202500:30	–	euvd
Metasploit	WordPress Asset-Manager PHP File Upload Vulnerability	26 May 201200:00	–	metasploit
NVD	CVE-2012-10026	5 Aug 202520:15	–	nvd
OpenVAS	WordPress Asset Manager Plugin 0.2 'upload.php' Arbitrary File Upload Vulnerability - Active Check	8 Jun 201200:00	–	openvas
Positive Technologies	PT-2025-31978 · WordPress · Asset-Manager	5 Aug 202500:00	–	ptsecurity
RedhatCVE	CVE-2012-10026	7 Aug 202520:31	–	redhatcve

Vulners

CNA

Node

jkriddle asset-managerRange0–2.0

[
  {
    "vendor": "jkriddle",
    "product": "asset-manager",
    "modules": [
      "upload.php"
    ],
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThanOrEqual": "2.0",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
raw	www.raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/wp_asset_manager_upload_exec.rb
web	www.web.archive.org/web/20150106144832/http://www.opensyscom.fr:80/Actualites/wordpress-plugins-asset-manager-shell-upload-vulnerability.html
exploit-db	www.exploit-db.com/exploits/23652
exploit-db	www.exploit-db.com/exploits/18993
wordpress	www.wordpress.org/plugins/asset-manager/
vulncheck	www.vulncheck.com/advisories/wordpress-plugin-asset-manager-php-file-upload

Parameter	Position	Path	Description	CWE
Filedata	request body	wp-content/plugins/asset-manager/upload.php	Unauthenticated arbitrary file upload vulnerability in Asset-Manager <= 2.0 enables remote code execution by uploading a PHP payload via upload.php.	CWE-434

15 Jul 2026 01:23Current

7.8High risk

Vulners AI Score7.8

CVSS 410

EPSS0.01194

SSVC

CWE-434