CVE-2015-10140

Ajax Load More < 2.8.1.2 - Subscriber+ File Upload & Deletion

High · published July 22, 2025

CVSS v3.1
8.8
EPSS
2%
Percentile
75.1
In the wild
Unconfirmed
What it is

The Ajax Load More plugin before 2.8.1.2 does not have authorisation in some of its AJAX actions, allowing any authenticated users, such as subscriber, to upload and delete arbitrary files.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01576 · 75.1th percentile
Published
2025-07-22T13:20Z
EPSS history
Timeline
  • 22 JUL 13:20Z
    Ajax Load More < 2.8.1.2 - Subscriber+ File Upload & Deletion
    cvelistv5