CVE-2015-1172: WordPress Holding Pattern theme unrestricted file upload leads to PHP code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityUnauthenticated remote code execution with a high EPSS score and public exploit references, though the affected theme is old and no KEV listing is present.

What it is

The Holding Pattern theme (holding_pattern) 0.6 and earlier for WordPress contains an unrestricted file upload flaw in admin/upload-file.php. An attacker can upload a file with a PHP extension and then request it directly, causing arbitrary PHP code to execute on the server. This gives full control of the affected WordPress installation.

Impact

Successful exploitation lets a remote attacker run arbitrary PHP code on the web server, which typically means full compromise of the WordPress site and any data or credentials it can reach. The CVSS 2.0 vector rates confidentiality, integrity and availability impact as partial.

Attack surface

The flaw is reached over the network through admin/upload-file.php in the theme; the CVSS 2.0 vector AV:N/AC:L/Au:N indicates no authentication is required. No user interaction is described in the record.

Exploitation

CISA KEV does not list this CVE, but EPSS gives a 30-day probability of 0.59254 (99.073 percentile), indicating high predicted exploitation activity. Reference titles such as "Shell Upload" suggest public proof-of-concept material exists, though the record does not explicitly confirm active exploitation.

What to do

• Update or remove the Holding Pattern theme; versions 0.6 and earlier are affected, so apply any vendor fix or replace the theme entirely.
• If the theme cannot be updated, remove or disable admin/upload-file.php and block direct requests to it at the web server.
• Restrict upload handling to authenticated, authorized users and validate file extensions and MIME types server-side.
• Configure the web server to refuse execution of PHP files in WordPress upload directories.
• Audit the site for unexpected PHP files in upload paths and remove any found.

Detection

• Monitor web server logs for POST requests to admin/upload-file.php followed by GET requests to newly created .php files.
• Alert on PHP files appearing in WordPress upload directories or other writable paths.
• Scan the filesystem for recently modified or created PHP files outside expected plugin and theme locations.
• Review access logs for direct requests to uploaded files with PHP extensions from external IPs.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.