{"id":"CVE-2013-7102","aliases":["EUVD-2013-6888","GHSA-vqcv-hf93-cvhh"],"status":"published","title":"Multiple unrestricted file upload vulnerabilities in (1) media-upload.php, (2) media-upload...","description":"Multiple unrestricted file upload vulnerabilities in (1) media-upload.php, (2) media-upload-lncthumb.php, and (3) media-upload-sq_button.php in lib/admin/ in the OptimizePress theme before 1.61 for WordPress allow remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in images_comingsoon, images_lncthumbs, or images_optbuttons in wp-content/uploads/optpress/, as exploited in the wild in November 2013.","severity":{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.14802,"percentile":0.96707,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-20"],"published":"2013-12-23T23:00:00Z","modified":"2026-06-17T00:01:25Z","exploits":[{"source":"metasploit","id":"exploit/unix/webapp/wp_optimizepress_upload","title":"WordPress OptimizePress Theme File Upload Vulnerability","type":"exploit","platform":"PHP","date":"2013-11-29","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/unix/webapp/wp_optimizepress_upload"}],"products":[{"vendor":"optimizepress","product":"optimizepress"}],"references":[{"url":"http://help.optimizepress.com/customer/portal/articles/1381790-important-optimizepress-1-0-security-update","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.osirt.com/2013/11/wordpress-optimizepress-hack-file-upload-vulnerability/","tags":["x_refsource_MISC","x_transferred","Exploit"]},{"url":"http://blog.sucuri.net/2013/12/wordpress-optimizepress-theme-file-upload-vulnerability.html","tags":["x_refsource_MISC","x_transferred","Exploit"]},{"url":"http://seclists.org/fulldisclosure/2013/Dec/127","tags":["mailing-list","x_refsource_FULLDISC","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-7102"},{"url":"http://www.osirt.com/2013/11/wordpress-optimizepress-hack-file-upload-vulnerability"},{"url":"https://github.com/advisories/GHSA-vqcv-hf93-cvhh"}],"sources":{"cve":[{"id":"CVE-2013-7102","description":"Multiple unrestricted file upload vulnerabilities in (1) media-upload.php, (2) media-upload-lncthumb.php, and (3) media-upload-sq_button.php in lib/admin/ in the OptimizePress theme before 1.61 for WordPress allow remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in images_comingsoon, images_lncthumbs, or images_optbuttons in wp-content/uploads/optpress/, as exploited in the wild in November 2013.","status":"published","published":"2013-12-23T23:00:00Z","modified":"2024-08-06T17:53:45.88Z","updated_at":"2026-11-02T14:34:59.222149Z"}],"euvd":[{"id":"EUVD-2013-6888","description":"Multiple unrestricted file upload vulnerabilities in (1) media-upload.php, (2) media-upload-lncthumb.php, and (3) media-upload-sq_button.php in lib/admin/ in the OptimizePress theme before 1.61 for WordPress allow remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in images_comingsoon, images_lncthumbs, or images_optbuttons in wp-content/uploads/optpress/, as exploited in the wild in November 2013.","status":"published","published":"2013-12-23T23:00:00Z","modified":"2024-08-06T17:53:45Z","updated_at":"2026-11-03T01:56:24.379982Z"}],"ghsa":[{"id":"GHSA-vqcv-hf93-cvhh","title":"Multiple unrestricted file upload vulnerabilities in (1) media-upload.php, (2) media-upload...","description":"Multiple unrestricted file upload vulnerabilities in (1) media-upload.php, (2) media-upload-lncthumb.php, and (3) media-upload-sq_button.php in lib/admin/ in the OptimizePress theme before 1.61 for WordPress allow remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in images_comingsoon, images_lncthumbs, or images_optbuttons in wp-content/uploads/optpress/, as exploited in the wild in November 2013.","status":"published","published":"2022-05-17T04:55:59Z","modified":"2025-04-11T04:18:31Z","cwes":["CWE-20"],"updated_at":"2026-11-02T15:01:15.391359Z"}],"nvd":[{"id":"CVE-2013-7102","description":"Multiple unrestricted file upload vulnerabilities in (1) media-upload.php, (2) media-upload-lncthumb.php, and (3) media-upload-sq_button.php in lib/admin/ in the OptimizePress theme before 1.61 for WordPress allow remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in images_comingsoon, images_lncthumbs, or images_optbuttons in wp-content/uploads/optpress/, as exploited in the wild in November 2013.","status":"published","published":"2013-12-23T23:55:04.513Z","modified":"2026-06-17T00:01:25.307Z","cvss":[{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:02:44.596064Z"}]}}