CVE-2015-1172

Holding Pattern < 0.6 - Unauthenticated Arbitrary File Upload via admin/upload-file.php

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2015-1172. PoCs published by Metasploit, Alexander Borg, rastating, including Metasploit module exploits/unix/webapp/wp_holding_pattern_file_upload.

AI-analyzed exploit summary This Metasploit module exploits an arbitrary file upload vulnerability in the WordPress Holding Pattern theme (CVE-2015-1172), allowing unauthenticated attackers to upload and execute PHP scripts on the target server.

Description

Unrestricted file upload vulnerability in admin/upload-file.php in the Holding Pattern theme (aka holding_pattern) 0.6 and earlier for WordPress allows remote attackers to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via a direct request to the file in an unspecified directory.

Exploits (2)

exploitdb WORKING POC VERIFIED
by Metasploit · rubywebappslinux
https://www.exploit-db.com/exploits/41698

This Metasploit module exploits an arbitrary file upload vulnerability in the WordPress Holding Pattern theme (CVE-2015-1172), allowing unauthenticated attackers to upload and execute PHP scripts on the target server.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: WordPress Holding Pattern theme (all versions)
No auth needed
Prerequisites: Target must have the Holding Pattern theme installed · Target must be accessible via HTTP
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit WORKING POC EXCELLENT
by Alexander Borg, rastating · rubypocphp
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/wp_holding_pattern_file_upload.rb

This Metasploit module exploits an unauthenticated arbitrary file upload vulnerability in the WordPress Holding Pattern theme (CVE-2015-1172). It uploads a malicious PHP payload via a flawed upload script and executes it to achieve remote code execution.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: WordPress Holding Pattern theme (all versions)
No auth needed
Prerequisites: Target must have the Holding Pattern theme installed · Target must be accessible via HTTP
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (3)

Core 3
Core References
Third Party Advisory x_refsource_misc
https://wpvulndb.com/vulnerabilities/7784
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/72546

Scores

EPSS 0.5925
EPSS Percentile 99.0%

Details

Status published
Products (1)
holding_pattern_project/holding_pattern < 0.6
Published Feb 11, 2015
Tracked Since Feb 18, 2026