CVE-2012-5318

Kish Guest Posting plugin 1.2 - RCE

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2012-5318. PoCs published by EgiX.

AI-analyzed exploit summary This exploit targets an unrestricted file upload vulnerability in WordPress Kish Guest Posting Plugin 1.0. It uploads a malicious PHP file via a multipart form request and provides a pseudo-shell for remote command execution.

Description

Unrestricted file upload vulnerability in uploadify/scripts/uploadify.php in the Kish Guest Posting plugin 1.2 for WordPress allows remote attackers to execute arbitrary code by uploading a file with a double extension, then accessing it via a direct request to the file in the directory specified by the folder parameter. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1125.

Exploits (1)

exploitdb WORKING POC
by EgiX · phpwebappsphp
https://www.exploit-db.com/exploits/18412

This exploit targets an unrestricted file upload vulnerability in WordPress Kish Guest Posting Plugin 1.0. It uploads a malicious PHP file via a multipart form request and provides a pseudo-shell for remote command execution.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: WordPress Kish Guest Posting Plugin 1.0
No auth needed
Prerequisites: Target must have the vulnerable plugin installed · Network access to the target web server
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (2)

Core 2
Core References
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/47688
Mailing List mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2012/03/08/1

Scores

EPSS 0.0654
EPSS Percentile 92.9%

Details

Status published
Products (1)
kishore_asokan/kish_guest_posting_plugin 1.2
Published Oct 08, 2012
Tracked Since Feb 18, 2026