TI-2015-08066 CVE-2015-10138 · GHSA-cp8h-xgpv-mj82Work The Flow File Upload <= 2.5.2 - Arbitrary File UploadPriority MEDIUM 49The Work The Flow File Upload plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the jQuery-File-Upload-9.5.0 server and test files in versions up to, and including, 2.5.2…CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.04239 · Published 2025-07-19 · No fix listed CWE-434