CVE-2012-10026

This Metasploit module exploits an unauthenticated file upload vulnerability in the WordPress Asset-Manager plugin (<= 2.0) to achieve remote code execution by uploading a malicious PHP payload.

This exploit demonstrates an arbitrary file upload vulnerability in the WordPress Asset Manager plugin (v0.2), allowing an attacker to upload a malicious PHP file (e.g., a web shell) via a cURL POST request to the vulnerable endpoint. The uploaded file can then be accessed to execute arbitrary PHP code.

This Metasploit module exploits an unauthenticated file upload vulnerability in WordPress Asset-Manager plugin <= 2.0, allowing arbitrary PHP code execution by uploading a malicious file to a temp directory and then executing it.