CVE-2016-15043

CRITICAL EXPLOITED NUCLEI

WP Mobile Detector <3.5 - File Upload

Title source: llm

Description

The WP Mobile Detector plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in resize.php file in versions up to, and including, 3.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.

Exploits (1)

metasploit WORKING POC EXCELLENT

by pluginvulnerabilities.com, Aaditya Purani, h00die · rubypocphp

https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/wp_mobile_detector_upload_execute.rb

View Code ZIP pw:eip

Nuclei Templates (1)

WP Mobile Detector <= 3.5 - Unrestricted File Upload

CRITICALVERIFIEDby D3nverNg,thewindghost

References (6)

[Exploit, Third Party Advisory] https://aadityapurani.com/2016/06/03/mobile-detector-poc/

[Exploit, Press/Media Coverage] https://blog.sucuri.net/2016/06/wp-mobile-detector-vulnerability-being-exploited-in-the-wild.html

[Product] https://wordpress.org/plugins/wp-mobile-detector/changelog/

[Exploit, Third Party Advisory] https://wpscan.com/vulnerability/e4739674-eed4-417e-8c4d-2f5351b057cf

[Exploit, Third Party Advisory] https://www.pluginvulnerabilities.com/2016/05/31/aribitrary-file-upload-vulnerability-in-wp-mobile-detector/

[Third Party Advisory] https://www.wordfence.com/threat-intel/vulnerabilities/id/5a5d5dbd-36f0-4886-adf8-045ec9c2e306?source=cve

Scores

CVSS v3 9.8

EPSS 0.8252

EPSS Percentile 99.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

VulnCheck KEV 2016-06-03

CWE

CWE-434

Status published

Products (2)

Websitez.com, LLC/WP Mobile Detector < 3.5

wp_mobile_detector_project/wp_mobile_detector < 3.5

Published Jul 19, 2025

Tracked Since Feb 18, 2026