Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Powerplay Gallery WordPress plugin enables code execution via upload

CVE-2015-5681 · published 11 years ago
Summary

The Powerplay Gallery plugin version 3.3 for WordPress lets anyone upload files without checking their type. An attacker could place a malicious program on the server and then run it by visiting the uploaded file, potentially taking control of the site. Update the plugin to a patched version or remove it, and restrict file‑upload permissions on the server.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
wpslideshow powerplay_gallery 3.3
cpe:2.3:a:wpslideshow:powerplay_gallery:3.3:*:*:*:*:wordpress:*:*
Original advisory text
Unrestricted file upload vulnerability in upload.php in the Powerplay Gallery plugin 3.3 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable exten...
Unrestricted file upload vulnerability in upload.php in the Powerplay Gallery plugin 3.3 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in *_uploadfolder/big/.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
5% chance of attack within 30 days
Timeline
Published18 Aug 2015
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2015-5681 · NVD
Track software like this
Free during beta