Read the docs
TI-2012-05352 Aliases CVE-2012-6634GHSA-44pr-x897-56j8

wp-admin/media-upload.php in WordPress before 3.3.3 allows remote attackers to obtain…

Priority LOW 32CWE-264Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Partial · Partial · None
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-264.

Summary

wp-admin/media-upload.php in WordPress before 3.3.3 allows remote attackers to obtain sensitive information or bypass intended media-attachment restrictions via a post_id value.

Why it matters now

EPSS 0.02053 81st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 18

CPEVersionsRoleVendor
cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*up to 3.3.2VulnerableWordPress
cpe:2.3:a:wordpress:wordpress:3.0:*:*:*:*:*:*:*3.0VulnerableWordPress
cpe:2.3:a:wordpress:wordpress:3.0.1:*:*:*:*:*:*:*3.0.1VulnerableWordPress
cpe:2.3:a:wordpress:wordpress:3.0.2:*:*:*:*:*:*:*3.0.2VulnerableWordPress
cpe:2.3:a:wordpress:wordpress:3.0.3:*:*:*:*:*:*:*3.0.3VulnerableWordPress
cpe:2.3:a:wordpress:wordpress:3.0.4:*:*:*:*:*:*:*3.0.4VulnerableWordPress
cpe:2.3:a:wordpress:wordpress:3.0.5:*:*:*:*:*:*:*3.0.5VulnerableWordPress
cpe:2.3:a:wordpress:wordpress:3.0.6:*:*:*:*:*:*:*3.0.6VulnerableWordPress
cpe:2.3:a:wordpress:wordpress:3.1:*:*:*:*:*:*:*3.1VulnerableWordPress
cpe:2.3:a:wordpress:wordpress:3.1.1:*:*:*:*:*:*:*3.1.1VulnerableWordPress
  • cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:* Versions up to 3.3.2 Vulnerable ·WordPress
  • cpe:2.3:a:wordpress:wordpress:3.0:*:*:*:*:*:*:* Versions 3.0 Vulnerable ·WordPress
  • cpe:2.3:a:wordpress:wordpress:3.0.1:*:*:*:*:*:*:* Versions 3.0.1 Vulnerable ·WordPress
  • cpe:2.3:a:wordpress:wordpress:3.0.2:*:*:*:*:*:*:* Versions 3.0.2 Vulnerable ·WordPress
  • cpe:2.3:a:wordpress:wordpress:3.0.3:*:*:*:*:*:*:* Versions 3.0.3 Vulnerable ·WordPress
  • cpe:2.3:a:wordpress:wordpress:3.0.4:*:*:*:*:*:*:* Versions 3.0.4 Vulnerable ·WordPress
  • cpe:2.3:a:wordpress:wordpress:3.0.5:*:*:*:*:*:*:* Versions 3.0.5 Vulnerable ·WordPress
  • cpe:2.3:a:wordpress:wordpress:3.0.6:*:*:*:*:*:*:* Versions 3.0.6 Vulnerable ·WordPress
  • cpe:2.3:a:wordpress:wordpress:3.1:*:*:*:*:*:*:* Versions 3.1 Vulnerable ·WordPress
  • cpe:2.3:a:wordpress:wordpress:3.1.1:*:*:*:*:*:*:* Versions 3.1.1 Vulnerable ·WordPress
Show 8 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:wordpress:wordpress:3.1.2:*:*:*:*:*:*:*3.1.2VulnerableWordPress
cpe:2.3:a:wordpress:wordpress:3.1.3:*:*:*:*:*:*:*3.1.3VulnerableWordPress
cpe:2.3:a:wordpress:wordpress:3.1.4:*:*:*:*:*:*:*3.1.4VulnerableWordPress
cpe:2.3:a:wordpress:wordpress:3.2:*:*:*:*:*:*:*3.2VulnerableWordPress
cpe:2.3:a:wordpress:wordpress:3.2:beta1:*:*:*:*:*:*3.2 beta1VulnerableWordPress
cpe:2.3:a:wordpress:wordpress:3.2.1:*:*:*:*:*:*:*3.2.1VulnerableWordPress
cpe:2.3:a:wordpress:wordpress:3.3:*:*:*:*:*:*:*3.3VulnerableWordPress
cpe:2.3:a:wordpress:wordpress:3.3.1:*:*:*:*:*:*:*3.3.1VulnerableWordPress
  • cpe:2.3:a:wordpress:wordpress:3.1.2:*:*:*:*:*:*:* Versions 3.1.2 Vulnerable ·WordPress
  • cpe:2.3:a:wordpress:wordpress:3.1.3:*:*:*:*:*:*:* Versions 3.1.3 Vulnerable ·WordPress
  • cpe:2.3:a:wordpress:wordpress:3.1.4:*:*:*:*:*:*:* Versions 3.1.4 Vulnerable ·WordPress
  • cpe:2.3:a:wordpress:wordpress:3.2:*:*:*:*:*:*:* Versions 3.2 Vulnerable ·WordPress
  • cpe:2.3:a:wordpress:wordpress:3.2:beta1:*:*:*:*:*:* Versions 3.2 beta1 Vulnerable ·WordPress
  • cpe:2.3:a:wordpress:wordpress:3.2.1:*:*:*:*:*:*:* Versions 3.2.1 Vulnerable ·WordPress
  • cpe:2.3:a:wordpress:wordpress:3.3:*:*:*:*:*:*:* Versions 3.3 Vulnerable ·WordPress
  • cpe:2.3:a:wordpress:wordpress:3.3.1:*:*:*:*:*:*:* Versions 3.3.1 Vulnerable ·WordPress

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2012-6634
  2. 2026-10-03 Alias added: GHSA-44pr-x897-56j8

References

Advisory 1

Other 1

  • TI-2026-45010 WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution KEVCVSS 3.1CRITICAL 9.8
  • TI-2016-08118 The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow… KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-83466 Predictable staging paths let attackers run code in WordPress Core KEVCVSS 3.1HIGH 8.1
  • TI-2026-59973 An unauthenticated attacker can make `get_page_template()` page-template resolution… KEVCVSS 3.1HIGH 8.1
  • TI-2016-08129 The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass… CVSS 3.1CRITICAL 9.8
  • TI-2026-42844 WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query KEVCVSS 3.1MEDIUM 5.9
See all 356 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences