CVE-2012-2435: Directory traversal vulnerability in the captcha module in Pligg CMS before 1.2.2 allows remote authenticat...

Security readout for executives and security teams

CVE-2012-2435 affects Pligg CMS before 1.2.2. An authenticated attacker could abuse the captcha module to traverse directories and include local files, potentially executing them. The CVE also notes CSRF as a demonstrated attack path. No source in the bundle confirms active exploitation. Exposure is most likely in legacy Pligg CMS installations older than 1.2.2 where the captcha module and module.php are reachable by authenticated users. Treat this as a legacy CMS risk requiring prompt remediation if Pligg is still deployed. The issue can cross from file access into code execution, but current exploitation evidence is not provided. Mitigation focus: Upgrade Pligg CMS to version 1.2.2 or later, following vendor guidance.; Review the linked vendor revision and release references for the exact corrected behavior.; Restrict access to authenticated CMS functions until legacy systems are upgraded..

Prepared

Jun 24, 2026, 12:34 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.