CVE-2012-3576

Severity: critical (CVSS 10.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 18.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2012-06-16 · updated 2026-06-16
Weakness: CWE-264

Description

Unrestricted file upload vulnerability in php/upload.php in the wpStoreCart plugin before 2.5.30 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in uploads/wpstorecart.

Affected products

Jquindlen Wpstorecart: through 2.5.29; 0.62, 1.0.0, 2.0.0, 2.0.1, 2.0.2, 2.0.3 (+91)

References

http://plugins.trac.wordpress.org/changeset?old_path=%2Fwpstorecart&old=555124&new_path=%2Fwpstorecart&new=555124
http://secunia.com/advisories/49459
http://wordpress.org/extend/plugins/wpstorecart/changelog/
http://www.exploit-db.com/exploits/19023
https://exchange.xforce.ibmcloud.com/vulnerabilities/76166
http://plugins.trac.wordpress.org/changeset?old_path=%2Fwpstorecart&old=555124&new_path=%2Fwpstorecart&new=555124
http://secunia.com/advisories/49459
http://wordpress.org/extend/plugins/wpstorecart/changelog/
http://www.exploit-db.com/exploits/19023
https://exchange.xforce.ibmcloud.com/vulnerabilities/76166

Get alerted when CVE-2012-3576 or the next vulnerability affects your stack