Arbitrary File Upload Vulnerability in N-Media Website Contact Form Plugin for WordPress
CVE-2015-10137
9.8CRITICAL
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 22 July 2025
What is CVE-2015-10137?
The N-Media Website Contact Form with File Upload plugin for WordPress allows unauthenticated users to upload arbitrary files due to a lack of proper file type validation in the 'upload_file()' function. This security flaw, present in versions up to 1.3.4, opens the door for attackers to execute arbitrary code on the server, potentially leading to remote code execution. Website administrators using this plugin should take immediate action to mitigate this risk by updating to the latest version, which addresses the file validation issue.
Affected Version(s)
Website Contact Form With File Upload * <= 1.3.4