CVE-2012-10019

The Front End Editor plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the upload.php file in versions before 2.3. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://packetstormsecurity.com/files/132303/	Exploit Third Party Advisory VDB Entry
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=600233%40front-end-editor&old=569105%40front-end-editor&sfp_email=&sfph_mail=	Product
https://web.archive.org/web/20120712205339/https%3A//www.opensyscom.fr/Actualites/wordpress-plugins-front-end-editor-arbitrary-file-upload-vulnerability.html	Exploit Third Party Advisory
https://www.cybersecurity-help.cz/vdb/SB2012070701	Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/f271c2e7-9d58-4dea-95d3-3ffc4ec7c3b2?source=cve	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:scribu:front-end_editor:*:*:*:*:*:wordpress:*:*

History

No history.

Information

Published : 2025-07-19 10:15

Updated : 2025-12-19 18:53

NVD link : CVE-2012-10019

Mitre link : CVE-2012-10019

CVE.ORG link : CVE-2012-10019

JSON object : View

Products Affected

scribu

front-end_editor

CWE

CWE-434

Unrestricted Upload of File with Dangerous Type

{"id": "CVE-2012-10019", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security@wordfence.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2025-07-19T10:15:22.123", "references": [{"url": "https://packetstormsecurity.com/files/132303/", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=600233%40front-end-editor&old=569105%40front-end-editor&sfp_email=&sfph_mail=", "tags": ["Product"], "source": "security@wordfence.com"}, {"url": "https://web.archive.org/web/20120712205339/https%3A//www.opensyscom.fr/Actualites/wordpress-plugins-front-end-editor-arbitrary-file-upload-vulnerability.html", "tags": ["Exploit", "Third Party Advisory"], "source": "security@wordfence.com"}, {"url": "https://www.cybersecurity-help.cz/vdb/SB2012070701", "tags": ["Third Party Advisory"], "source": "security@wordfence.com"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f271c2e7-9d58-4dea-95d3-3ffc4ec7c3b2?source=cve", "tags": ["Third Party Advisory"], "source": "security@wordfence.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@wordfence.com", "description": [{"lang": "en", "value": "CWE-434"}]}], "descriptions": [{"lang": "en", "value": "The Front End Editor plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the upload.php file in versions before 2.3. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible."}, {"lang": "es", "value": "El complemento Front End Editor para WordPress es vulnerable a la carga de archivos arbitrarios debido a la falta de validaci\u00f3n del tipo de archivo mediante el archivo upload.php en versiones anteriores a la 2.3. Esto permite que atacantes no autenticados carguen archivos arbitrarios en el servidor de los sitios afectados, lo que podr\u00eda posibilitar la ejecuci\u00f3n remota de c\u00f3digo."}], "lastModified": "2025-12-19T18:53:35.477", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:scribu:front-end_editor:*:*:*:*:*:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "DB7B471B-30D4-427C-9258-64C20D8165B4", "versionEndExcluding": "2.3"}], "operator": "OR"}]}], "sourceIdentifier": "security@wordfence.com"}