What’s Vulnerable › Vulnerabilities
CVE-2015-10140: Ajax Load More < 2.8.1.2 - Subscriber+ File Upload & Deletion
- Severity: high (CVSS 8.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 1.7% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2025-07-22 · updated 2026-06-17
- Weakness: CWE-862
Description
The Ajax Load More plugin before 2.8.1.2 does not have authorisation in some of its AJAX actions, allowing any authenticated users, such as subscriber, to upload and delete arbitrary files.
Affected products
- dcooney Ajax Load More – Infinite Scroll, Load More, & Lazy Load: before 2.8.1.2 — fixed in 2.8.1.2
How to fix
Upgrade to a fixed version: dcooney Ajax Load More – Infinite Scroll, Load More, & Lazy Load 2.8.1.2. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2015-10140 or the next vulnerability affects your stack