CVE-2007-2485: WordPress myflash plugin remote file inclusion in myflash-button.php

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityUnauthenticated remote code execution with public exploit code and very high EPSS, but the affected plugin is old and no KEV listing or ransomware use is documented.

What it is

The myflash 1.00 and earlier plugin for WordPress contains a PHP remote file inclusion flaw in myflash-button.php. The wpPATH parameter is passed to a PHP include without validation, letting a remote attacker supply a URL to an external file that is then executed as PHP code. This matters because it gives unauthenticated attackers code execution on the web server.

Impact

An attacker can execute arbitrary PHP code in the context of the web server, leading to full compromise of the WordPress site and potentially the underlying host. This can result in data theft, defacement, or use of the server as a foothold for further attacks.

Attack surface

The flaw is reachable over the network through HTTP requests to myflash-button.php, with the malicious URL supplied in the wpPATH parameter. No authentication or user interaction is required, as reflected by the CVSS vector AV:N/AC:L/Au:N.

Exploitation

Public exploit code is referenced (Exploit-DB 3828 and a SecurityFocus entry tagged Exploit), and EPSS is high at roughly 0.55 (99th percentile), though the CVE is not listed in CISA KEV. No ransomware association is documented.

What to do

• Update the myflash plugin to a version later than 1.00 or remove it if no fixed release exists, since the vendor page is tagged as a patch reference.
• If the plugin cannot be removed, block or filter requests to myflash-button.php and reject wpPATH values containing URL schemes or remote hosts.
• Disable allow_url_include and allow_url_fopen in PHP configuration to prevent remote file inclusion from succeeding.
• Apply a web application firewall rule to detect and block remote file inclusion attempts against this endpoint.
• Audit the web server and WordPress installation for signs of compromise, since successful exploitation yields code execution.

Detection

• Search web server logs for requests to myflash-button.php with wpPATH parameters containing http://, https://, ftp://, or other URL schemes.
• Monitor for unexpected outbound HTTP requests from the web server to external hosts following plugin requests.
• Look for newly created or modified PHP files in the WordPress uploads, plugins, or web root directories.
• Review PHP error logs for include or fopen warnings referencing remote URLs.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.