CVE-2012-1011

CVE-2012-1011 describes an arbitrary file upload vulnerability in the AllWebMenus plugin 1.1.8 for WordPress. This flaw allows unauthenticated remote attackers to bypass access restrictions by manipulating the HTTP_REFERER header, enabling them to upload and execute arbitrary PHP code. With a CVSS score of 7.5, this vulnerability is considered highly severe due to its low attack complexity and potential for complete compromise of confidentiality, integrity, and availability. While not listed in CISA's KEV catalog, an exploit is publicly available on ExploitDB, indicating the existence of proof-of-concept code, though there is no evidence of widespread active exploitation or significant community discussion.