CVE-2012-10019 CRITICAL

CVE-2012-10019: Front-end Editor < 2.3 - Arbitrary File Upload

Vendor Scribu
Product Front-end Editor
Weakness CWE-434 · Unrestricted file upload
Published July 19, 2025
Last update April 8, 2026
View on NVD All CVEs

CVSS base score

9.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

The Front End Editor plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the upload.php file in versions before 2.3. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.

Explanation of Vulnerability in Simple Terms

02Summary

Front-end Editor versions before 2.3 do not properly validate file uploads, allowing an attacker to upload arbitrary files to the site without authentication. This can lead to remote code execution if executable files are uploaded to web-accessible directories. All versions from 0 to 2.2 are affected.

What an attacker can do

03Attacker Capabilities

Upload arbitrary files to the site and execute code on the server.

Potential impact on your site

04Site Impact

An attacker can take full control of your site by uploading malicious code.

Conditions required to exploit

05Prerequisites

Network access only; no authentication or user interaction required.

Key dates

06Disclosure timeline

July 19, 2025 CVE published
April 8, 2026 Record updated