CVE-2015-10140
Ajax Load More < 2.8.1.2 - Subscriber+ File Upload & Deletion
Vexday Risk Score
36Attention
SSVC decision (CISA)
Attend
PoC available → attend closely
CVSS 8.8EPSS 1.0%KEV nãoPoC —Nuclei —Metasploit simPatch —
Lifecycle
10 Oct 2015Metasploit module available
22 Jul 2025Published on NVD
Recommendation: Plan a near-term fix — a public PoC already exists.
The Ajax Load More plugin before 2.8.1.2 does not have authorisation in some of its AJAX actions, allowing any authenticated users, such as subscriber, to upload and delete arbitrary files.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Unknown · Ajax Load MoreWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →