CVE-2012-3577: nmedia member_conversation
Vulnerability summary
CVE-2012-3577 is a critical (CVSS 9.8) vulnerability in nmedia member_conversation. EPSS estimates a 13.65% chance of exploitation in the next 30 days, higher than 96.4% of scored vulnerabilities. 4 public exploits are recorded. Fixed in 1.4.
Timeline
- 17-06-2012PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
Unrestricted file upload vulnerability in doupload.php in the Nmedia Member Conversation plugin before 1.4 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in wp-content/uploads/user_uploads.
CVSS metrics
2 scores · 2 sources · 2 versionsEPSS trend
Probability
13.65%
Chance of exploitation in the next 30 days
Percentile
96%
Versus all other CVEs
30-day change
0.00 pp
From 13.65% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
4 foundExploit Reference (packetstormsecurity.org)
Maturity: unknown
Exploit Reference (securityfocus.com)
Maturity: unknown
Exploit Reference (opensyscom.fr)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-264Permissions, Privileges, and Access ControlsWeaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
- CWE-434Unrestricted Upload of File with Dangerous TypeThe product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Affected systems
Nmedia1 product
- member_conversation≤ 1.3 | 1.0 | 1.2
Wordpress1 product
- wordpress-member-private-conversation< 1.4
2 vendors · 2 products