CVE-2012-10064: Legacy WordPress Plugin Bug Enabling Silent Remote Code Execution

Vulnerability Overview

CVE ID: CVE-2012-10064
Affected Component: Omni Secure Files WordPress Plugin
Affected Versions: ≤ 0.1.13
Attack Type: Remote, Unauthenticated
Impact: Full Remote Code Execution
User Interaction Required: None

This vulnerability exists in the Omni Secure Files WordPress plugin due to an insecure file upload mechanism left exposed in a bundled example script. The plugin includes a plupload example file that was never meant to be accessible in production but is deployed by default and left unprotected.

Because the upload endpoint does not require authentication and does not validate file types, attackers can upload malicious server-side scripts (such as PHP files) directly to the web server and execute them remotely.

CVSS & Severity

CVSS Score: ~9.0+ (Critical)
Severity: Critical
Attack Complexity: Low
Privileges Required: None
Scope: Changed
Confidentiality / Integrity / Availability Impact: High

This vulnerability is considered critical because it allows complete compromise of the affected WordPress instance and potentially the underlying server.

Root Cause Analysis

The core issue is the presence of an example upload script:

/wp-content/plugins/omni-secure-files/plupload/examples/upload.php

Key security failures include:

No authentication or authorization checks
No validation of uploaded file extensions
No MIME-type enforcement
Uploaded files stored in a web-accessible location
Server executes uploaded scripts directly

This violates fundamental secure coding principles for file uploads and directly exposes the application to exploitation.

How the Vulnerability Can Be ExploitedCVE-2012-10064: Legacy WordPress Plugin Bug Enabling Silent Remote Code Execution

Educational explanation only

An attacker scans a target website for the vulnerable plugin path.
The attacker sends an HTTP POST request to the exposed upload endpoint.
A malicious file (for example, a PHP script) is uploaded successfully.
The file is saved in a directory that is accessible via a browser.
The attacker accesses the uploaded file URL.
The server executes the file, granting the attacker remote code execution.

Once exploited, the attacker may:

Deploy web shells
Create administrator accounts
Steal database credentials
Modify site content
Use the server for further attacks

Proof of Concept (PoC) Availability

Public PoCs exist
Exploitation is straightforward
No authentication bypass or complex chaining required

PoCs demonstrate how a simple HTTP multipart upload is enough to compromise the site.
These are commonly used for security testing, validation, and education, but also make the vulnerability attractive to attackers due to its low barrier to exploitation.

MITRE ATT&CK Mapping

Initial Access:
- Exploit Public-Facing Application
Execution:
- Command and Script Interpreter
Persistence (Post-Exploitation):
- Web Shell Deployment
Privilege Escalation (Possible):
- Exploiting server misconfigurations or weak file permissions

Detection Strategy

1. Web Server Logs

Monitor for:

HTTP POST requests to: /wp-content/plugins/omni-secure-files/plupload/examples/upload.php
Requests followed by GET requests to newly uploaded .php or executable files
Unusual user agents or repeated upload attempts

Log sources:

Apache / Nginx access logs
Reverse proxy or CDN logs
Web Application Firewall logs

2. File Integrity Monitoring

Alert when:

New .php, .phtml, .php5 files appear in:
- wp-content/uploads/
- Plugin directories
Files are created by the web server user (e.g., www-data, apache)

This is one of the most reliable indicators of exploitation.

3. Endpoint / EDR Signals

Look for:

Web server spawning shells or unexpected child processes
PHP processes executing system commands
Changes to WordPress core files after an upload event

4. WAF / IDS Detection Logic

Trigger alerts for:

Multipart file uploads to known vulnerable paths
File uploads containing executable extensions
Uploads where Content-Type does not match file extension

Example Detection Rule

IF
  request.method = POST
  AND request.uri CONTAINS "plupload/examples/upload.php"
THEN
  ALERT "Possible unauthenticated arbitrary file upload attempt"

This rule should be treated as high priority and investigated immediately.

Business Impact

If exploited, this vulnerability can lead to:

Full website compromise
Loss of sensitive user data
SEO poisoning or malware distribution
Blacklisting by search engines
Legal and compliance exposure
Loss of customer trust

Because exploitation does not require authentication, any exposed vulnerable site is at risk.

Remediation & Mitigation

Recommended Fix (Official)

Upgrade the plugin to version 0.1.14 or later, where the vulnerable example upload script has been removed or secured.

Official patch / upgrade link:
https://wordpress.org/plugins/omni-secure-files/

Additional Defensive Measures

Remove unused plugins entirely
Never deploy example or test scripts in production
Block access to /plupload/examples/ paths at the web server or WAF level
Store uploaded files outside the web root
Enforce strict file type validation and allow-lists
Disable PHP execution in upload directories

Final Takeaway

CVE-2012-10064 is a classic but extremely dangerous vulnerability caused by insecure default files left accessible in production. Despite its age, it remains relevant because similar misconfigurations still occur frequently.

Any system running the affected plugin version should be considered compromised until proven otherwise and must be patched or decommissioned immediately.