CVE-2016-15043 CRITICAL

CVE-2016-15043: WP Mobile Detector <= 3.5 - Arbitrary File Upload

Vendor Websitez.com, Llc
Product WP Mobile Detector
Weakness CWE-434 · Unrestricted file upload
Published July 19, 2025
Last update April 8, 2026
View on NVD All CVEs

CVSS base score

9.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

The WP Mobile Detector plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in resize.php file in versions up to, and including, 3.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.

Explanation of Vulnerability in Simple Terms

02Summary

WP Mobile Detector versions 3.5 and earlier contain an unrestricted file upload vulnerability. An attacker can upload arbitrary files to the site without authentication, potentially allowing them to run their own code on the server. This affects all installations of the plugin up to version 3.5.

What an attacker can do

03Attacker Capabilities

Upload arbitrary files to the site and execute code on the server without needing to log in.

Potential impact on your site

04Site Impact

Complete compromise of the site: attackers can run code, steal data, modify content, or take the site offline.

Conditions required to exploit

05Prerequisites

Network access to the site; no authentication or user interaction required.

Key dates

06Disclosure timeline

July 19, 2025 CVE published
April 8, 2026 Record updated