Security readout for executives and security teams
Plain-English summary
CVE-2015-9340 affects the WordPress wp-file-upload plugin before version 3.0.0. The issue is weak filtering of risky uploaded file types, including PHP, HTML, JavaScript, and .htaccess-related files. That can create serious website risk, but the provided sources do not confirm exploitability conditions or active exploitation.
Executive priority
Treat as priority remediation for any public WordPress site using the affected plugin. There is no confirmed active exploitation in the supplied evidence, but unsafe upload handling on public websites can become high-impact quickly.
Technical view
The CVE describes insufficient upload restrictions in wp-file-upload before 3.0.0 for extensions including php, phtml, html, js, and htaccess variants. The bundle provides no CVSS score, CWE mapping, privilege requirement, attack vector, or patch note details beyond the affected version boundary.
Likely exposure
Exposure is likely limited to WordPress sites running wp-file-upload versions older than 3.0.0, especially where upload features are enabled. The sources do not identify affected configurations, roles, or whether authentication is required.
Exploitation context
The CVE is not listed as KEV in the provided bundle, and no cited source confirms active exploitation. The risk comes from allowing dangerous upload extensions, but exploitation prerequisites are not documented here.
Researcher notes
Evidence is sparse: no CVSS, CWE, exploitation status, or detailed fix information is included. Analysis should focus on plugin version validation, upload authorization paths, allowed extensions, and whether uploaded files can be executed or served by the web server.
Mitigation direction
- Inventory WordPress sites for the wp-file-upload plugin and installed version.
- Upgrade wp-file-upload to version 3.0.0 or later after checking vendor guidance.
- Restrict upload permissions to trusted users until remediation is complete.
- Review web server rules for execution of uploaded PHP or .htaccess files.
- Check the WordPress plugin page for current maintenance and changelog details.
Validation and detection
- Confirm whether wp-file-upload is installed on each WordPress site.
- Verify installed plugin versions are not earlier than 3.0.0.
- Review upload settings and user roles allowed to upload files.
- Inspect upload directories for risky extensions named in the CVE.
- Check logs for unexpected uploads around exposed forms.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2015-9340 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://wordpress.org/plugins/wp-file-upload/#developersCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.