Arbitrary file upload in Wp-Property WordPress Plugin
CVE-2012-10027
WP-Property plugin for WordPress up to and including version 1.35.0 contains an unauthenticated file upload vulnerability in the third-party `uploadify.php` script. A remote attacker can upload arbitrary PHP files to a temporary directory without authentication, leading to remote code execution.
Vulnerability class: Unrestricted File Upload
Published · last modified .
EPSS exploit prediction
EPSS: 0.019 (78.5th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 78th percentile — 78.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.013 · newest: 0.019 · change: +0.006
Affected products
- Wp-Property WordPress Plugin — versions 0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- wordpress.org/plugins/wp-property/ (product)
- raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/u… (exploit)
- www.exploit-db.com/exploits/18987 (exploit)
- www.exploit-db.com/exploits/23651 (exploit)
- web.archive.org/web/20150103065650/http://www.opensyscom.fr:80/Actualites/wordp… (technical-description, exploit)
- www.vulncheck.com/advisories/wordpress-plugin-wp-property-php-file-upload (third-party-advisory)
Frequently asked questions
- What is CVE-2012-10027?
- CVE-2012-10027 is a vulnerability in Wp-Property WordPress Plugin, classified under Unrestricted Upload of File with Dangerous Type. Published 2025-08-05.
- Is CVE-2012-10027 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.