CVE-2015-10138

CRITICAL 9.8CVE-2015-10138 · Published 19/07/2025 · updated 27/07/2026

Package	Affected versions	Patched versions
work the flow file upload lyntonreed	`≤ 2.5.2`	No fix yet

Description

The Work The Flow File Upload plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the jQuery-File-Upload-9.5.0 server and test files in versions up to, and including, 2.5.2. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.

References

packetstormsecurity.com/files/131294 · Exploit
packetstormsecurity.com/files/131512 · Exploit
plugins.trac.wordpress.org/changeset · Patch
plugins.trac.wordpress.org/changeset · Patch
wpscan.com/vulnerability/a49a81a9-3d4b-4c8d-b719-fc513aceecc6 · Third Party Advisory
acunetix.com/vulnerabilities/web/wordpress-plugin-work-the-flow-file-upload-arbitrary-file-upload-2-5-2 · Third Party Advisory
homelab.it/index.php/2015/04/04/wordpress-work-the-flow-file-upload-vulnerability · Exploit
rapid7.com/db/modules/exploit/unix/webapp/wp_worktheflow_upload · Third Party Advisory
wordfence.com/threat-intel/vulnerabilities/id/eb271cc8-01ec-45eb-9d6f-efc55c7c3923 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free