CVE-2015-10140

HIGH

Ajax Load More <2.8.1.2 - Auth Bypass

Title source: llm

Description

The Ajax Load More plugin before 2.8.1.2 does not have authorisation in some of its AJAX actions, allowing any authenticated users, such as subscriber, to upload and delete arbitrary files.

Exploits (1)

metasploit WORKING POC EXCELLENT
by PizzaHatHacker · rubypocphp
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/wp_ajax_load_more_file_upload.rb

References (1)

Scores

CVSS v3 8.8
EPSS 0.5710
EPSS Percentile 98.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-862
Status published
Products (1)
connekthq/ajax_load_more < 2.8.1.2
Published Jul 22, 2025
Tracked Since Feb 18, 2026