Read the docs
TI-2011-04328 Aliases CVE-2011-5051GHSA-fcw4-qcmw-m499

Multiple unrestricted file upload vulnerabilities in the WP Symposium plugin before…

Priority MEDIUM 40Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA.

Summary

Multiple unrestricted file upload vulnerabilities in the WP Symposium plugin before 11.12.24 for WordPress allow remote attackers to execute arbitrary code by uploading a file with an executable extension using (1) uploadify/upload_admin_avatar.php or (2) uploadify/upload_profile_avatar.php, then accessing it via a direct request to the file in an unspecified directory inside the webroot.

Why it matters now

EPSS 0.04195 91st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 16

CPEVersionsRoleVendor
cpe:2.3:a:wpsymposium:wp_symposium:*:*:*:*:*:*:*:*up to 11.12.08VulnerableWpsymposium
cpe:2.3:a:wpsymposium:wp_symposium:11.9.10:*:*:*:*:*:*:*11.9.10VulnerableWpsymposium
cpe:2.3:a:wpsymposium:wp_symposium:11.9.14:*:*:*:*:*:*:*11.9.14VulnerableWpsymposium
cpe:2.3:a:wpsymposium:wp_symposium:11.9.17:*:*:*:*:*:*:*11.9.17VulnerableWpsymposium
cpe:2.3:a:wpsymposium:wp_symposium:11.9.24:*:*:*:*:*:*:*11.9.24VulnerableWpsymposium
cpe:2.3:a:wpsymposium:wp_symposium:11.10.1:*:*:*:*:*:*:*11.10.1VulnerableWpsymposium
cpe:2.3:a:wpsymposium:wp_symposium:11.10.8:*:*:*:*:*:*:*11.10.8VulnerableWpsymposium
cpe:2.3:a:wpsymposium:wp_symposium:11.10.15:*:*:*:*:*:*:*11.10.15VulnerableWpsymposium
cpe:2.3:a:wpsymposium:wp_symposium:11.10.22:*:*:*:*:*:*:*11.10.22VulnerableWpsymposium
cpe:2.3:a:wpsymposium:wp_symposium:11.10.29:*:*:*:*:*:*:*11.10.29VulnerableWpsymposium
  • cpe:2.3:a:wpsymposium:wp_symposium:*:*:*:*:*:*:*:* Versions up to 11.12.08 Vulnerable ·Wpsymposium
  • cpe:2.3:a:wpsymposium:wp_symposium:11.9.10:*:*:*:*:*:*:* Versions 11.9.10 Vulnerable ·Wpsymposium
  • cpe:2.3:a:wpsymposium:wp_symposium:11.9.14:*:*:*:*:*:*:* Versions 11.9.14 Vulnerable ·Wpsymposium
  • cpe:2.3:a:wpsymposium:wp_symposium:11.9.17:*:*:*:*:*:*:* Versions 11.9.17 Vulnerable ·Wpsymposium
  • cpe:2.3:a:wpsymposium:wp_symposium:11.9.24:*:*:*:*:*:*:* Versions 11.9.24 Vulnerable ·Wpsymposium
  • cpe:2.3:a:wpsymposium:wp_symposium:11.10.1:*:*:*:*:*:*:* Versions 11.10.1 Vulnerable ·Wpsymposium
  • cpe:2.3:a:wpsymposium:wp_symposium:11.10.8:*:*:*:*:*:*:* Versions 11.10.8 Vulnerable ·Wpsymposium
  • cpe:2.3:a:wpsymposium:wp_symposium:11.10.15:*:*:*:*:*:*:* Versions 11.10.15 Vulnerable ·Wpsymposium
  • cpe:2.3:a:wpsymposium:wp_symposium:11.10.22:*:*:*:*:*:*:* Versions 11.10.22 Vulnerable ·Wpsymposium
  • cpe:2.3:a:wpsymposium:wp_symposium:11.10.29:*:*:*:*:*:*:* Versions 11.10.29 Vulnerable ·Wpsymposium
Show 6 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:wpsymposium:wp_symposium:11.11.5:*:*:*:*:*:*:*11.11.5VulnerableWpsymposium
cpe:2.3:a:wpsymposium:wp_symposium:11.11.12:*:*:*:*:*:*:*11.11.12VulnerableWpsymposium
cpe:2.3:a:wpsymposium:wp_symposium:11.11.19:*:*:*:*:*:*:*11.11.19VulnerableWpsymposium
cpe:2.3:a:wpsymposium:wp_symposium:11.11.26:*:*:*:*:*:*:*11.11.26VulnerableWpsymposium
cpe:2.3:a:wpsymposium:wp_symposium:11.12.03:*:*:*:*:*:*:*11.12.03VulnerableWpsymposium
cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*all versionsRunning onWordPress
  • cpe:2.3:a:wpsymposium:wp_symposium:11.11.5:*:*:*:*:*:*:* Versions 11.11.5 Vulnerable ·Wpsymposium
  • cpe:2.3:a:wpsymposium:wp_symposium:11.11.12:*:*:*:*:*:*:* Versions 11.11.12 Vulnerable ·Wpsymposium
  • cpe:2.3:a:wpsymposium:wp_symposium:11.11.19:*:*:*:*:*:*:* Versions 11.11.19 Vulnerable ·Wpsymposium
  • cpe:2.3:a:wpsymposium:wp_symposium:11.11.26:*:*:*:*:*:*:* Versions 11.11.26 Vulnerable ·Wpsymposium
  • cpe:2.3:a:wpsymposium:wp_symposium:11.12.03:*:*:*:*:*:*:* Versions 11.12.03 Vulnerable ·Wpsymposium
  • cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:* Versions all versions Running on ·WordPress

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2011-5051
  2. 2026-10-03 Alias added: GHSA-fcw4-qcmw-m499

References

Other 3

  • TI-2015-05478 SQL injection vulnerability in the WP Symposium plugin before 15.8 for WordPress allows… CVSS 2.0HIGH 7.5
  • TI-2015-02940 SQL injection vulnerability in forum.php in the WP Symposium plugin before 15.4 for… CVSS 2.0HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences