CVE-2015-4133: ReFlex Gallery WordPress plugin unrestricted file upload leads to PHP code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityThe flaw allows unauthenticated remote code execution, public exploit code exists, and EPSS is very high, though it is not in KEV and affects an older plugin version.

What it is

The ReFlex Gallery plugin for WordPress before 3.1.4 exposes admin/scripts/FileUploader/php.php, which accepts uploaded files without restricting the extension. An attacker can upload a file with a PHP extension and then request it directly from the uploads/ directory, causing the server to execute the code. This gives remote code execution on the WordPress host, which is why the flaw matters despite being an older plugin issue.

Impact

An attacker gains arbitrary PHP code execution on the web server, enabling full compromise of the WordPress site and potentially the underlying host. This can lead to data theft, defacement, persistence, or use of the server as a foothold for further attacks.

Attack surface

The vulnerable endpoint is reachable over the network via HTTP requests to the plugin's admin/scripts/FileUploader/php.php path, and the uploaded file is then retrieved through a direct request to uploads/. The CVSS vector AV:N/AC:L/Au:N indicates no authentication is required and no user interaction is needed.

Exploitation

The record is not listed in CISA KEV, but EPSS is high at 0.61382 (99.1st percentile) and multiple references are tagged Exploit, including Exploit-DB and Packet Storm entries, indicating public exploit code exists.

What to do

• Update the ReFlex Gallery plugin to version 3.1.4 or later, which is the patched release per the changelog reference.
• If the plugin cannot be updated or is unused, remove or disable it entirely.
• Restrict execution of PHP files in the WordPress uploads/ directory via web server configuration.
• Enforce file type and extension validation on any file upload functionality and store uploads outside the web root where possible.
• Monitor and restrict access to plugin admin script paths that should not be publicly reachable.

Detection

• Search web server logs for POST requests to admin/scripts/FileUploader/php.php followed by GET requests to uploads/ paths ending in .php.
• Look for newly created .php files in the WordPress uploads/ directory and alert on any such file.
• Monitor for outbound or inbound requests to known exploit paths associated with ReFlex Gallery and review file integrity on the web root.
• Use file integrity monitoring to detect unexpected PHP files added under wp-content/uploads/.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.