CVE-2016-10959

MEDIUM 6.5CVE-2016-10959 · Published 16/09/2019 · updated 17/06/2026

In short

CVE-2016-10959 is a MEDIUM (CVSS 6.5) vulnerability affecting estatik (estatik).
Chance of exploitation in the next 30 days (EPSS): 1.1%, higher than 65.9% of all vulnerabilities.
Fix: update to 2.3.1 or later.

Package	Affected versions	Patched versions
estatik estatik	`< 2.3.1`	`2.3.1`

Description

The estatik plugin before 2.3.1 for WordPress has authenticated arbitrary file upload (exploitable with CSRF) via es_media_images[] to wp-admin/admin-ajax.php.

References

wordpress.org/plugins/estatik · Release Notes
pluginvulnerabilities.com/2016/08/19/authenticated-arbitrary-file-upload-vulnerability-in-estatik · Exploit

More vulnerabilities in estatik

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free