Vulnerability record · CVE-2014-10021 · published 13 January 2015
CVE-2014-10021: WP Symposium plugin unrestricted file upload allows remote code execution
Wpsymposiumpro · Wp Symposium
UploadHandler.php in the WP Symposium plugin 14.11 for WordPress does not restrict uploaded file types, so a file with an executable extension can be placed on the server. Because the uploaded file is reachable by a direct request under server/php/, this turns a simple upload into remote code execution on the web server.
Description
Unrestricted file upload vulnerability in UploadHandler.php in the WP Symposium plugin 14.11 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in server/php/.
AV:N/AC:L/Au:N/C:P/I:P/A:P
Automated analysis
high priorityUnauthenticated remote code execution with public exploit code and very high EPSS, though the vulnerable plugin is old and no KEV listing or active exploitation is confirmed.
What it is
UploadHandler.php in the WP Symposium plugin 14.11 for WordPress does not restrict uploaded file types, so a file with an executable extension can be placed on the server. Because the uploaded file is reachable by a direct request under server/php/, this turns a simple upload into remote code execution on the web server.
Impact
An unauthenticated attacker can upload and then execute arbitrary code with the privileges of the web server user, leading to full compromise of the WordPress host.
Attack surface
Reachable over the network through the plugin's upload handler; the CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required. The uploaded file is then invoked by a direct HTTP request to server/php/.
Exploitation
Not listed in CISA KEV, but EPSS is high (0.58973, 99th percentile) and public Exploit-DB and VDB references exist, indicating exploit code is publicly available.
What to do
- Update or remove the WP Symposium plugin; version 14.11 is the only version named in the record, so confirm the fixed release with the vendor before upgrading.
- If the plugin cannot be removed immediately, block or disable the UploadHandler.php endpoint and the server/php/ upload path at the web server or WAF.
- Configure the web server to deny execution of script files in upload directories and restrict allowed upload extensions.
- Run WordPress with a least-privilege web server account and disable PHP execution in writable directories.
- Audit the server/php/ directory and other upload locations for unexpected executable files and remove any found.
Detection
- Monitor web server logs for POST requests to UploadHandler.php followed by GET requests to files under server/php/.
- Alert on newly created files with executable extensions (php, phtml, php5, etc.) in WordPress upload or plugin directories.
- Scan the server/php/ path and upload directories for webshell indicators and unexpected file hashes.
- Review HTTP responses returning 200 for direct requests to uploaded files in server/php/.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| http://www.exploit-db.com/exploits/35543 | ExploitThird Party AdvisoryVDB Entry |
| http://www.securityfocus.com/bid/71686 | Broken Link |
| http://www.exploit-db.com/exploits/35543 | ExploitThird Party AdvisoryVDB Entry |
| http://www.securityfocus.com/bid/71686 | Broken Link |
Track CVE-2014-10021 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2014-10021), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
