CVE-2016-15043 is a critical arbitrary file upload vulnerability affecting the WP Mobile Detector plugin for WordPress, specifically in versions up to and including 3.5. The flaw stems from a lack of file type validation in the resize.php file, allowing unauthenticated attackers to upload malicious files. With a CVSS score of 9.8 (CRITICAL) and an EPSS score indicating high exploitability, this vulnerability poses a severe risk of remote code execution, leading to complete compromise of affected systems. While not on the CISA KEV catalog, exploit modules are publicly available in Metasploit and Nuclei, demonstrating readily accessible attack vectors, despite a lack of broader community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 3.5CPE matchmatch criteria | cpe:2.3:a:wp_mobile_detector_project:wp_mobile_detector:*:*:*:*:*:wordpress:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.