CVE-2015-1000013

HIGH 7.8 ALL-YEARS

Published 2016-10-06 · Last modified 2024-08-06 · mitre · NVD: Modified

Remote file upload vulnerability in wordpress plugin csv2wpec-coupon v1.1

REPORTED EXPLOITATION

VulnCheck KEV reports exploitation for this CVE. These are source-specific reports; review the details and vendor guidance below.

Exploitation likelihood

2.1%chance of exploitation in 30 days · 81st percentile

○ In CISA KEV○ Catalogued PoC

Impact if exploited

7.8CVSS 3.0 · HIGH · NVD

ConfidentialityHigh
IntegrityHigh
AvailabilityHigh

What an attacker needs

⚠Access: Requires local access to the host
✓Privileges: No account or privileges required
⚠User interaction: A user must take an action (click / open a file)
✓Complexity: No special conditions — reliably repeatable

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked weekly for the full archive, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Affected

Vendors Csv2wpec Coupon Project

Products Csv2wpec Coupon

Weakness (CWE)

CWE-434: Unrestricted file upload

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References and research data (JSON)

Additional exploitation reports

Source-specific reports, separate from CISA KEV. Repeated observations from one source are not independent confirmations.

VulnCheck KEV · 2021-01-26T00:00:00Z
Source guidance: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Source ransomware assessment: Unknown
VulnCheck KEV · CVE-2015-1000013 · Updated 2021-01-26T00:00:00Z
VulnCheck KEV · 2021-01-26T00:00:00ZVulnCheck KEV · CVE-2015-1000013

Known Affected Software Configurations

Vendor	Product	Version range
Csv2wpec Coupon Project	Csv2wpec Coupon	1.1

All CVSS metrics

HIGH 7.8 v3.0 · NVD Primary
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
MEDIUM 5 v2.0 · NVD Primary
AV:N/AC:L/Au:N/C:N/I:P/A:N

References

Exploit-tagged references (not proof of a PoC)

http://www.vapidlabs.com/advisory.php?v=153 x_refsource_MISCx_transferredExploitThird Party AdvisoryCVE record · mitre · Updated 2016-11-25T19:57:01.000Z
CVE record · CVE · Updated 2024-08-06T08:58:26.519Z
NVD · CVE-2015-1000013 · Updated 2026-06-17T00:21:16.437

Advisories

https://euvd.enisa.europa.eu/vulnerability/EUVD-2015-1021 ADVISORYEUVD · EUVD-2015-1021
https://vulncheck.com/kev ADVISORYVulnCheck KEV · CVE-2015-1000013 · Updated 2021-01-26T00:00:00Z

Technical & other

http://www.securityfocus.com/bid/94497 vdb-entryx_refsource_BIDx_transferredCVE record · mitre · Updated 2016-11-25T19:57:01.000Z
CVE record · CVE · Updated 2024-08-06T08:58:26.519Z
NVD · CVE-2015-1000013 · Updated 2026-06-17T00:21:16.437
https://www.akamai.com/blog/security/what-happens-when-your-vulnerability-is-weaponized-for-botnet-proliferation KEV reportVulnCheck KEV · CVE-2015-1000013 · Updated 2021-01-26T00:00:00Z

Sources: NVD · CVE.org · All sources and attribution · EPSS