Understanding the WPshop 2 – E-Commerce Plugin Vulnerability
A serious security flaw has been identified in the WPshop 2 – E-Commerce plugin for WordPress. This vulnerability, tracked as CVE-2015-10135, allows unauthorized individuals to upload harmful files to websites running the affected plugin. If exploited, this could lead to attackers taking full control of a website, potentially compromising data and disrupting services.
The core issue lies within a function called ajaxUpload, where the plugin failed to properly check the type of files being uploaded. This oversight means that instead of just allowing legitimate images or documents, an attacker could upload malicious script files. Since this can be done without needing to log in, it poses a significant risk to any website using vulnerable versions of the plugin.
CVE Details
- Product Name: WPshop 2 – E-Commerce plugin for WordPress
- Published Date: July 19, 2025
- Severity: Critical
- Status: Analyzed
Affected Products
This vulnerability impacts the WPshop 2 – E-Commerce plugin for WordPress, specifically all versions released before 1.3.9.6. If you are using an older version of this popular e-commerce plugin, your website is at risk.
Current Status
The vulnerability has been thoroughly analyzed, meaning its details and potential impact are well-understood by the cybersecurity community. This analysis helps in developing and deploying effective countermeasures.
Severity Level
CVE-2015-10135 is rated with a Critical severity level, boasting a CVSS score of 9.8. This high rating indicates that the vulnerability is easy to exploit, does not require any special privileges or user interaction, and could result in a complete compromise of the affected system. The potential for unauthenticated remote code execution makes this a top-priority concern for site administrators.
Possible Solutions
The most crucial step to protect your WordPress site from this arbitrary file upload vulnerability is to update your WPshop 2 – E-Commerce plugin immediately. The developers released a fix in version 1.3.9.6. Ensure your plugin is running this version or a newer one.
Beyond updating, it’s always a good practice to:
- Regularly back up your website data.
- Implement a robust Web Application Firewall (WAF) to help detect and block malicious uploads.
- Keep all other WordPress plugins, themes, and the core WordPress installation updated to their latest versions.
For more general security advice, you might find our article on Understanding and Preventing Remote Code Execution Vulnerabilities helpful.
References
https://g0blin.co.uk/g0blin-00036/
https://github.com/espreto/wpsploit/blob/master/modules/exploits/unix/webapp/wp_wpshop_ecommerce_file_upload.rb
https://plugins.trac.wordpress.org/changeset/1103406
https://www.wordfence.com/threat-intel/vulnerabilities/id/32e8224d-a653-48d7-a3f4-338fc0c1dc77?source=cve
