blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2015-2825

HIGH 7.5 CVSS 2.0
Published
April 21, 2015
Last modified
June 17, 2026
NVD status
Modified
Reported by
cve@mitre.org
CVSS vector
AV:N/AC:L/Au:N/C:P/I:P/A:P

Description

Unrestricted file upload vulnerability in sam-ajax-admin.php in the Simple Ads Manager plugin before 2.5.96 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in the directory specified by the path parameter.

Affected WordPress components

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • n/a n/a — Versions not specified
  • simple_ads_manager_project simple_ads_manager — Up to and including 2.5.94

References

  • packetstormsecurity.com http://packetstormsecurity.com/files/131282/WordPress-Simple-Ads-Manager-2.5.94-File-Upload.html Exploit
  • seclists.org http://seclists.org/fulldisclosure/2015/Apr/8 Exploit
  • www.itas.vn http://www.itas.vn/news/ITAS-Team-found-out-multiple-critical-vulnerabilities-in-Hakin9-IT-Security-Magazine-78.html Exploit
  • wordpress.org https://wordpress.org/plugins/simple-ads-manager/changelog/ Patch
  • www.exploit-db.com https://www.exploit-db.com/exploits/36614/
  • nvd.nist.gov Official NVD record