Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2012-6512: Organizer plugin for WordPress can reveal site path

CVE-2012-6512 · published 13 years ago

Summary

The Organizer plugin version 1.2.1 for WordPress can disclose the directory where the site is installed when accessed remotely. Knowing the installation path makes it easier for attackers to plan additional attacks. Apply the latest plugin update or remove the plugin if a fix is not available.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
organizer_project	organizer	<= 1.2.1 `cpe:2.3:a:organizer_project:organizer::::::wordpress::*`

Original advisory text

The Organizer plugin 1.2.1 for WordPress allows remote attackers to obtain the installation path via unspecified vectors to (1) plugin_hook.php, (2) page/index.php, (3) page/dir.php (4) page/options.php, (5) page/resize.php, (6) page/upload.php, (7) page/users.php, or (8) page/view.php.

References

http://packetstormsecurity.org/files/112086/WordPress-Organizer-1.2.1-Cross-Site... Exploit Third Party Advisory VDB Entry
http://websecurity.com.ua/5782 Exploit Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/75107 Third Party Advisory VDB Entry

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

5.0 Medium

Exploitation

3% chance of attack within 30 days

Type

CWE-200Information Exposure

Timeline

Published24 Jan 2013

Updated3 Nov 2026

First seen29 Sep 2026

Sources

CVE-2012-6512 · NVD

Track software like this

Free during beta