CVE-2015-4133

HIGH 7.5CVE-2015-4133 · Published 28/05/2015 · updated 17/06/2026

Package	Affected versions	Patched versions
reflex gallery reflex_gallery_project	`≤ 3.1.3`	No fix yet

Description

Unrestricted file upload vulnerability in admin/scripts/FileUploader/php.php in the ReFlex Gallery plugin before 3.1.4 for WordPress allows remote attackers to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via a direct request to the file in uploads/ directory.

References

osvdb.org/show/osvdb/88853
packetstormsecurity.com/files/130845 · Exploit
packetstormsecurity.com/files/131515 · Exploit
securityfocus.com/bid/57100
wordpress.org/plugins/reflex-gallery/changelog · Patch
wpvulndb.com/vulnerabilities/7867
exploit-db.com/exploits/36809 · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free