Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.8

FCChat Widget plugin lets attackers run code via uploaded files

CVE-2012-3578 · published 14 years ago
Summary

The FCChat Widget plugin for WordPress (versions 2.2.13.1 and earlier) lets anyone upload a file and then execute it on your site. This can give a hacker control over the server. Update the plugin to a fixed version or remove it if you cannot apply the patch.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
wordpress fcchat_widget <= 2.2.13.1
cpe:2.3:a:wordpress:fcchat_widget:*:*:*:*:*:*:*:*
Original advisory text
Unrestricted file upload vulnerability in html/Upload.php in the FCChat Widget plugin 2.2.13.1 and earlier for WordPress allows remote attackers to execute arbitrary code by uploading a file with a...
Unrestricted file upload vulnerability in html/Upload.php in the FCChat Widget plugin 2.2.13.1 and earlier for WordPress allows remote attackers to execute arbitrary code by uploading a file with a file with an executable extension followed by a safe extension, then accessing it via a direct request to the file in html/images.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
6.8 Medium
Exploitation
8% chance of attack within 30 days
Type
CWE-264Permissions, Privileges, and Access Controls
Timeline
Published17 Jun 2012
Updated15 Oct 2026
First seen29 Sep 2026
Sources
CVE-2012-3578 · NVD
Track software like this
Free during beta