CVE-2015-10135criticalCWE-434

CVE-2015-10135: critical vulnerability in eoxia WPshop 2 – E-Commerce

WPshop 2 – E-Commerce < 1.3.9.6 - Arbitrary File Upload

Published · Updated

43Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendcvss 9.8epss 4.3%
from disclosure to weapon0 days
Published on NVDJul 19
metasploitMar 9
exploitation probability
4.3%top 9% of all CVEs
observed exploitation
nono source reports it
The WPshop 2 – E-Commerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajaxUpload function in versions before 1.3.9.6. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
eoxia · WPshop 2 – E-Commerce
Related CVEs — eoxia WPshop 2 – E-Commerce

In the same product, most dangerous first.

CVE-2025-3852HIGHWPshop 2 – E-Commerce 2.0.0 - 2.6.0 - Authenticated (Subscriber+) Privilege Escalation via Account TakeoverEPSS 0.4%CVE-2025-3853MEDIUMWPshop 2 – E-Commerce 2.0.0 - 2.6.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Key GenerationEPSS 0.2%
References
https://g0blin.co.uk/g0blin-00036/https://github.com/espreto/wpsploit/blob/master/modules/exploits/unix/webapp/wp_wpshop_ecommerce_file_upload.rbhttps://plugins.trac.wordpress.org/changeset/1103406https://wordpress.org/plugins/wpshop/#developershttps://www.wordfence.com/threat-intel/vulnerabilities/id/32e8224d-a653-48d7-a3f4-338fc0c1dc77?source=cve