WordPress Work The Flow File Upload (CVE-2015-10138): Unauthenticated Arbitrary File Upload to RCE

One HTTP request can hand an attacker full control of your WordPress site. CVE-2015-10138 shows how a simple file upload flaw escalates to remote code execution (RCE) and complete server compromise. This post dissects the vulnerability, walks through a working proof of concept, and lays out what defenders and incident responders need to know.

---

Introduction

The Work The Flow File Upload plugin was never a household name, but at its peak it ran on over a thousand WordPress sites. It was meant to make file uploads easy for end users. Instead, a flaw in its bundled jQuery-File-Upload-9.5.0 component let anyone upload arbitrary files without authentication. CVE-2015-10138 allowed attackers to upload and run malicious files, most often PHP webshells, with no login required. That made it a target for mass exploitation and automated attack tools.

About the plugin:

• Work The Flow File Upload: A WordPress plugin for user-friendly file uploads. At its peak it had around 1,000 active installations. The severity of this flaw outweighs that small footprint, because any site running a vulnerable version can be fully compromised.

---

Technical information

Vulnerability mechanism

The flaw sits in the plugin's bundled jQuery-File-Upload-9.5.0 library. The server-side PHP handler at:

/wp-content/plugins/work-the-flow-file-upload/public/assets/jQuery-File-Upload-9.5.0/server/php/index.php

does not enforce file type validation and does not require authentication. Any remote user can upload arbitrary files, including executable PHP scripts, straight to the server.

Key technical weaknesses

• No file type validation: The upload handler does not restrict file extensions or check MIME types. Attackers can upload .php files or other executable content.
• Unauthenticated access: The upload endpoint performs no authentication or authorization checks.
• Predictable storage path: Uploaded files land in a known directory: /wp-content/plugins/work-the-flow-file-upload/public/assets/jQuery-File-Upload-9.5.0/server/php/files/

Exploitation flow

1. Crafted HTTP POST: The attacker sends a multipart/form-data POST request to the vulnerable endpoint with a malicious file, for example shell.php.
2. File upload: The server saves the file in the predictable directory, which is reachable over the web.
3. Remote execution: The attacker requests the uploaded PHP file through a browser or a direct HTTP request, running arbitrary code on the server.

Example HTTP request

POST /wp-content/plugins/work-the-flow-file-upload/public/assets/jQuery-File-Upload-9.5.0/server/php/index.php HTTP/1.1
Host: victim-site.com
Content-Type: multipart/form-data; boundary=---------------------------123456789123456

-----------------------------123456789123456
Content-Disposition: form-data; name="files[]"; filename="shell.php"
Content-Type: application/octet-stream

<?php system($_GET['cmd']); ?>
-----------------------------123456789123456--

Root cause

The root cause is the absence of both server-side file type validation and authentication. The upload handler trusts user input, so attackers can bypass any client-side restrictions and upload executable files.

---

Proof of concept

The Metasploit module wp_worktheflow_upload.rb automates the attack:

• It sends a crafted HTTP POST request to the plugin's upload endpoint.
• The request carries a malicious PHP file disguised as an allowed file type.
• After a successful upload, the module requests the file to trigger remote code execution and return a shell to the attacker.

Attack steps:

1. Set the target URL and payload path in Metasploit.
2. Run the module. It uploads the payload and executes it, granting remote shell access.

This works because the upload handler has no file type validation and no authentication.

Reference: Metasploit Module Source

---

Affected systems and versions

• Product: Work The Flow File Upload plugin for WordPress
• Affected versions: Up to and including 2.5.2
• Vulnerable component: jQuery-File-Upload-9.5.0 within the plugin
• Vulnerable endpoint: /wp-content/plugins/work-the-flow-file-upload/public/assets/jQuery-File-Upload-9.5.0/server/php/index.php
• Configuration: Every default installation of an affected version is vulnerable. No special configuration is required.

---

Vendor security history

• Previous vulnerabilities: The vendor has a history of critical flaws, including CVE-2014-7840 (file upload bypass) and unpatched high-severity issues.
• Patch response: Patch delays ranged from several days to weeks. The fix for CVE-2015-10138 shipped in version 2.5.3.
• Security maturity: The vendor relied on outdated third-party libraries and stopped maintenance after acquisition, which left legacy installs exposed.

---

References

• NVD Entry for CVE-2015-10138
• MITRE CVE Entry
• Acunetix Advisory
• WPScan Advisory
• Homelab.it Analysis
• Wordfence Threat Intel
• ExploitDB PoC 36640
• Packet Storm 131294
• Packet Storm 131512
• Rapid7 Metasploit Module
• Metasploit Module Source

Source: This report was created using AI

If you have suggestions for improvement or feedback, please reach out to us at [email protected]