CVE-2015-4336: cloner.functions.php in the XCloner plugin 3.1.2 for WordPress allows remote authenticated users to execute...

Security readout for executives and security teams

This flaw affects XCloner plugin 3.1.2 for WordPress. An authenticated remote user could make the plugin process crafted filenames with shell metacharacters and cause arbitrary command execution. That can turn a legitimate WordPress account into server-level compromise, depending on web server privileges. Public sources do not provide a CVSS score or confirmed active exploitation. Organizations are exposed if they run WordPress with XCloner plugin version 3.1.2 and allow untrusted or lower-trust authenticated users. Risk is higher where WordPress accounts are broadly issued, shared, or weakly governed. The source bundle does not identify other affected versions. Treat this as high priority where XCloner 3.1.2 is installed, especially on externally reachable WordPress sites. Although authentication is required and active exploitation is not confirmed, arbitrary command execution can lead to full site or server compromise. Prioritize inventory and removal or vendor-approved remediation. Mitigation focus: Inventory WordPress sites for XCloner plugin version 3.1.2.; Check vendor or maintainer guidance for a patched release or official workaround.; Disable or remove vulnerable XCloner deployments until vendor guidance is confirmed..

Prepared

Jun 13, 2026, 22:39 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.