CVE-2012-10019

CRITICAL

Front End Editor <2.3 - File Upload

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2012-10019. PoCs published by Sammy, including Metasploit module exploits/unix/webapp/wp_frontend_editor_file_upload.

AI-analyzed exploit summary This Metasploit module exploits an authenticated file upload vulnerability in the WordPress Front-end Editor plugin (CVE-2012-10019), allowing arbitrary PHP file uploads via a custom upload mechanism. The exploit uploads a PHP payload and triggers it to achieve remote code execution.

Description

The Front End Editor plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the upload.php file in versions before 2.3. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.

Exploits (1)

metasploit WORKING POC EXCELLENT

by Sammy · rubypoc

https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/wp_frontend_editor_file_upload.rb

View Code ZIP pw:eip

This Metasploit module exploits an authenticated file upload vulnerability in the WordPress Front-end Editor plugin (CVE-2012-10019), allowing arbitrary PHP file uploads via a custom upload mechanism. The exploit uploads a PHP payload and triggers it to achieve remote code execution.

Classification

Working Poc 95%

Attack Type

Rce

Complexity

Trivial

Reliability

Reliable

Target: WordPress Front-end Editor plugin 2.2.1

Auth required

Prerequisites: Valid WordPress credentials · Front-end Editor plugin version <= 2.2.1

MITRE ATT&CK

T1105 - Ingress Tool Transfer T1210 - Exploitation of Remote Services

devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (5)

Core 5

Core References

Exploit, Third Party Advisory, VDB Entry

https://packetstormsecurity.com/files/132303/

Product

https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=600233%40front-end-editor&old=569105%40front-end-editor&sfp_email=&sfph_mail=

Exploit, Third Party Advisory

https://web.archive.org/web/20120712205339/https%3A//www.opensyscom.fr/Actualites/wordpress-plugins-front-end-editor-arbitrary-file-upload-vulnerability.html

Third Party Advisory

https://www.cybersecurity-help.cz/vdb/SB2012070701

Third Party Advisory

https://www.wordfence.com/threat-intel/vulnerabilities/id/f271c2e7-9d58-4dea-95d3-3ffc4ec7c3b2?source=cve

Scores

CVSS v3 9.8

EPSS 0.7952

EPSS Percentile 99.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact total

Details

CWE

CWE-434

Status published

Products (2)

scribu/Front-end Editor < 2.3

scribu/front-end_editor < 2.3

Published Jul 19, 2025

Tracked Since Feb 18, 2026