Unrestricted file upload vulnerability in frames/upload-images.php in the Complete…
Priority LOW 39Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- Partial · Partial · Partial
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA.
Summary
Unrestricted file upload vulnerability in frames/upload-images.php in the Complete Gallery Manager plugin before 3.3.4 rev40279 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in wp-content/[year]/[month]/.
Why it matters now
EPSS 0.14771 96th percentileScored 2026-11-07
Public exploit Yes 4 exploit referencesTagged by NVD and the CNA
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 24
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:envato:complete_gallery_manager_plugin:*:rev39177:*:*:*:*:*:* | up to 3.3.3 | Vulnerable | envato |
| cpe:2.3:a:envato:complete_gallery_manager_plugin:1.0.0:rev25273:*:*:*:*:*:* | 1.0.0 rev25273 | Vulnerable | envato |
| cpe:2.3:a:envato:complete_gallery_manager_plugin:1.0.1:rev25421:*:*:*:*:*:* | 1.0.1 rev25421 | Vulnerable | envato |
| cpe:2.3:a:envato:complete_gallery_manager_plugin:1.0.2:rev25487:*:*:*:*:*:* | 1.0.2 rev25487 | Vulnerable | envato |
| cpe:2.3:a:envato:complete_gallery_manager_plugin:2.0.0:rev27524:*:*:*:*:*:* | 2.0.0 rev27524 | Vulnerable | envato |
| cpe:2.3:a:envato:complete_gallery_manager_plugin:2.0.1:rev27876:*:*:*:*:*:* | 2.0.1 rev27876 | Vulnerable | envato |
| cpe:2.3:a:envato:complete_gallery_manager_plugin:2.0.2:rev28693:*:*:*:*:*:* | 2.0.2 rev28693 | Vulnerable | envato |
| cpe:2.3:a:envato:complete_gallery_manager_plugin:2.0.3:rev28734:*:*:*:*:*:* | 2.0.3 rev28734 | Vulnerable | envato |
| cpe:2.3:a:envato:complete_gallery_manager_plugin:3.0.0:rev29469:*:*:*:*:*:* | 3.0.0 rev29469 | Vulnerable | envato |
| cpe:2.3:a:envato:complete_gallery_manager_plugin:3.0.1:rev29536:*:*:*:*:*:* | 3.0.1 rev29536 | Vulnerable | envato |
- cpe:2.3:a:envato:complete_gallery_manager_plugin:*:rev39177:*:*:*:*:*:* Versions up to 3.3.3 Vulnerable ·envato
- cpe:2.3:a:envato:complete_gallery_manager_plugin:1.0.0:rev25273:*:*:*:*:*:* Versions 1.0.0 rev25273 Vulnerable ·envato
- cpe:2.3:a:envato:complete_gallery_manager_plugin:1.0.1:rev25421:*:*:*:*:*:* Versions 1.0.1 rev25421 Vulnerable ·envato
- cpe:2.3:a:envato:complete_gallery_manager_plugin:1.0.2:rev25487:*:*:*:*:*:* Versions 1.0.2 rev25487 Vulnerable ·envato
- cpe:2.3:a:envato:complete_gallery_manager_plugin:2.0.0:rev27524:*:*:*:*:*:* Versions 2.0.0 rev27524 Vulnerable ·envato
- cpe:2.3:a:envato:complete_gallery_manager_plugin:2.0.1:rev27876:*:*:*:*:*:* Versions 2.0.1 rev27876 Vulnerable ·envato
- cpe:2.3:a:envato:complete_gallery_manager_plugin:2.0.2:rev28693:*:*:*:*:*:* Versions 2.0.2 rev28693 Vulnerable ·envato
- cpe:2.3:a:envato:complete_gallery_manager_plugin:2.0.3:rev28734:*:*:*:*:*:* Versions 2.0.3 rev28734 Vulnerable ·envato
- cpe:2.3:a:envato:complete_gallery_manager_plugin:3.0.0:rev29469:*:*:*:*:*:* Versions 3.0.0 rev29469 Vulnerable ·envato
- cpe:2.3:a:envato:complete_gallery_manager_plugin:3.0.1:rev29536:*:*:*:*:*:* Versions 3.0.1 rev29536 Vulnerable ·envato
Show 14 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:envato:complete_gallery_manager_plugin:3.1.0:rev30003:*:*:*:*:*:* | 3.1.0 rev30003 | Vulnerable | envato |
| cpe:2.3:a:envato:complete_gallery_manager_plugin:3.1.1:rev30900:*:*:*:*:*:* | 3.1.1 rev30900 | Vulnerable | envato |
| cpe:2.3:a:envato:complete_gallery_manager_plugin:3.2.0:rev31030:*:*:*:*:*:* | 3.2.0 rev31030 | Vulnerable | envato |
| cpe:2.3:a:envato:complete_gallery_manager_plugin:3.2.1:rev33197:*:*:*:*:*:* | 3.2.1 rev33197 | Vulnerable | envato |
| cpe:2.3:a:envato:complete_gallery_manager_plugin:3.2.2:rev33971:*:*:*:*:*:* | 3.2.2 rev33971 | Vulnerable | envato |
| cpe:2.3:a:envato:complete_gallery_manager_plugin:3.2.3:rev34390:*:*:*:*:*:* | 3.2.3 rev34390 | Vulnerable | envato |
| cpe:2.3:a:envato:complete_gallery_manager_plugin:3.2.4:rev34757:*:*:*:*:*:* | 3.2.4 rev34757 | Vulnerable | envato |
| cpe:2.3:a:envato:complete_gallery_manager_plugin:3.2.5:rev34942:*:*:*:*:*:* | 3.2.5 rev34942 | Vulnerable | envato |
| cpe:2.3:a:envato:complete_gallery_manager_plugin:3.2.6:rev36235:*:*:*:*:*:* | 3.2.6 rev36235 | Vulnerable | envato |
| cpe:2.3:a:envato:complete_gallery_manager_plugin:3.2.7:rev36257:*:*:*:*:*:* | 3.2.7 rev36257 | Vulnerable | envato |
| cpe:2.3:a:envato:complete_gallery_manager_plugin:3.2.8:rev36369:*:*:*:*:*:* | 3.2.8 rev36369 | Vulnerable | envato |
| cpe:2.3:a:envato:complete_gallery_manager_plugin:3.3.0:rev36620:*:*:*:*:*:* | 3.3.0 rev36620 | Vulnerable | envato |
| cpe:2.3:a:envato:complete_gallery_manager_plugin:3.3.1:rev38906:*:*:*:*:*:* | 3.3.1 rev38906 | Vulnerable | envato |
| cpe:2.3:a:envato:complete_gallery_manager_plugin:3.3.2:rev39009:*:*:*:*:*:* | 3.3.2 rev39009 | Vulnerable | envato |
- cpe:2.3:a:envato:complete_gallery_manager_plugin:3.1.0:rev30003:*:*:*:*:*:* Versions 3.1.0 rev30003 Vulnerable ·envato
- cpe:2.3:a:envato:complete_gallery_manager_plugin:3.1.1:rev30900:*:*:*:*:*:* Versions 3.1.1 rev30900 Vulnerable ·envato
- cpe:2.3:a:envato:complete_gallery_manager_plugin:3.2.0:rev31030:*:*:*:*:*:* Versions 3.2.0 rev31030 Vulnerable ·envato
- cpe:2.3:a:envato:complete_gallery_manager_plugin:3.2.1:rev33197:*:*:*:*:*:* Versions 3.2.1 rev33197 Vulnerable ·envato
- cpe:2.3:a:envato:complete_gallery_manager_plugin:3.2.2:rev33971:*:*:*:*:*:* Versions 3.2.2 rev33971 Vulnerable ·envato
- cpe:2.3:a:envato:complete_gallery_manager_plugin:3.2.3:rev34390:*:*:*:*:*:* Versions 3.2.3 rev34390 Vulnerable ·envato
- cpe:2.3:a:envato:complete_gallery_manager_plugin:3.2.4:rev34757:*:*:*:*:*:* Versions 3.2.4 rev34757 Vulnerable ·envato
- cpe:2.3:a:envato:complete_gallery_manager_plugin:3.2.5:rev34942:*:*:*:*:*:* Versions 3.2.5 rev34942 Vulnerable ·envato
- cpe:2.3:a:envato:complete_gallery_manager_plugin:3.2.6:rev36235:*:*:*:*:*:* Versions 3.2.6 rev36235 Vulnerable ·envato
- cpe:2.3:a:envato:complete_gallery_manager_plugin:3.2.7:rev36257:*:*:*:*:*:* Versions 3.2.7 rev36257 Vulnerable ·envato
- cpe:2.3:a:envato:complete_gallery_manager_plugin:3.2.8:rev36369:*:*:*:*:*:* Versions 3.2.8 rev36369 Vulnerable ·envato
- cpe:2.3:a:envato:complete_gallery_manager_plugin:3.3.0:rev36620:*:*:*:*:*:* Versions 3.3.0 rev36620 Vulnerable ·envato
- cpe:2.3:a:envato:complete_gallery_manager_plugin:3.3.1:rev38906:*:*:*:*:*:* Versions 3.3.1 rev38906 Vulnerable ·envato
- cpe:2.3:a:envato:complete_gallery_manager_plugin:3.3.2:rev39009:*:*:*:*:*:* Versions 3.3.2 rev39009 Vulnerable ·envato
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2013-5962
- 2026-10-03 Alias added: GHSA-9vx7-4qrw-wfw5
References
Sources
- CVE-2013-5962 · CVE Program
- CVE-2013-5962 · NVD
- FIRST EPSS
- GHSA-9vx7-4qrw-wfw5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences