CVE-2012-10019: Front-end Editor < 2.3 - Arbitrary File Upload

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-07-19 · updated 2026-06-16
Weakness: CWE-434

Description

The Front End Editor plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the upload.php file in versions before 2.3. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.

Affected products

scribu Front-end Editor: before 2.3 — fixed in 2.3

How to fix

Upgrade to a fixed version: scribu Front-end Editor 2.3. Check the vendor advisory for mitigations.

References

https://packetstormsecurity.com/files/132303/
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=600233%40front-end-editor&old=569105%40front-end-editor&sfp_email=&sfph_mail=
https://web.archive.org/web/20120712205339/https%3A//www.opensyscom.fr/Actualites/wordpress-plugins-front-end-editor-arbitrary-file-upload-vulnerability.html
https://www.cybersecurity-help.cz/vdb/SB2012070701
https://www.wordfence.com/threat-intel/vulnerabilities/id/f271c2e7-9d58-4dea-95d3-3ffc4ec7c3b2?source=cve

Get alerted when CVE-2012-10019 or the next vulnerability affects your stack