WP Mobile Detector Arbitrary File Upload Vulnerability (CVE-2016-15043) — Critical Severity

Website security is a constant battle, and even seemingly helpful tools can sometimes open doors for attackers. A critical vulnerability, identified as CVE-2016-15043, was found in the WP Mobile Detector plugin for WordPress. This flaw allowed unauthorized individuals to upload harmful files to affected websites, potentially giving them full control. Understanding such vulnerabilities is key to keeping your online presence safe.

CVE Details

Product Name: WP Mobile Detector plugin for WordPress
Published: July 19, 2025
Severity: Critical
Status: Analyzed

Affected Products

The vulnerability impacts the WP Mobile Detector plugin for WordPress, specifically in versions up to and including 3.5. If your WordPress site uses this plugin and has not been updated, it is at severe risk.

Current Status

This vulnerability has been thoroughly analyzed. The issue stems from the plugin’s resize.php file, which failed to properly check the types of files being uploaded. This oversight meant that an attacker could send any file, including malicious scripts, to your server.

Severity Level

CVE-2016-15043 carries a Critical severity rating with a CVSS score of 9.8. This high score reflects the serious nature of the vulnerability. An attacker exploiting this flaw could upload arbitrary files and potentially execute remote code, leading to a complete compromise of the affected WordPress website. Such a breach could result in data theft, website defacement, or further attacks on other systems.

Possible Solutions

To protect your WordPress site from this critical vulnerability, here are the essential steps:

1. Update Immediately: The most crucial step is to update the WP Mobile Detector plugin to version 3.7 or higher. The developers have patched this vulnerability by implementing file extension whitelisting, meaning only safe file types (like PNG, GIF, JPG, SVG) are now allowed.
2. Disable the Plugin: If you cannot update immediately, or no longer require its functionality, disable and remove the WP Mobile Detector plugin from your WordPress installation.
3. Enhanced Server Security: While not a complete fix, consider disabling PHP execution in the /wp-mobile-detector/cache subdirectory. However, this should not be your primary defense, as attackers might find other ways to exploit weaknesses. Implementing a robust web application firewall (WAF) can also help detect and block such exploit attempts.

Regularly updating all your plugins, themes, and WordPress core is a fundamental security practice that prevents many common vulnerabilities.

References

https://aadityapurani.com/2016/06/03/mobile-detector-poc/
https://blog.sucuri.net/2016/06/wp-mobile-detector-vulnerability-being-exploited-in-the-wild.html
https://wordpress.org/plugins/wp-mobile-detector/changelog/
https://wpscan.com/vulnerability/e4739674-eed4-417e-8c4d-2f5351b057cf
https://www.pluginvulnerabilities.com/2016/05/31/aribitrary-file-upload-vulnerability-in-wp-mobile-detector/
https://www.wordfence.com/threat-intel/vulnerabilities/id/5a5d5dbd-36f0-4886-adf8-045ec9c2e306?source=cve