CVE
CVE-2015-4133
Reflex gallery project · Reflex gallery
- First Reported
- Jun 13, 2026
- Latest Reported
- Jun 13, 2026
CVE Enrichment
- CVSS
- 7.5 HIGH
- EPSS
- 61.98%
- EPSS Percentile
- 99.18%
- CISA KEV
- Not listed
Description
Unrestricted file upload vulnerability in admin/scripts/FileUploader/php.php in the ReFlex Gallery plugin before 3.1.4 for WordPress allows remote attackers to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via a direct request to the file in uploads/ directory.
Technical Details
- CVSS Version
- 2.0
- CNA / NVD Source
- [email protected]
- Published
- 28-May-2015 21:59
- Last Modified
- 17-Jun-2026 07:26
- EPSS Date
- 2026-10-30
CVSS Vector
AV:N /
AC:L /
Au:N /
C:P /
I:P /
A:P
Affected Products / Versions
- reflex_gallery_project / reflex_gallery
Source: NVD CPE · affected
Version / affected range: * · through (inclusive) 3.1.3
cpe:2.3:a:reflex_gallery_project:reflex_gallery:*:*:*:*:*:wordpress:*:*
References
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
Last enrichment sync: 31-Oct-2026 10:46
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.
Reported Context (1)
- We direct Claude to exploit the reflex-gallery plugin, which carries an unauthenticated arbitrary file-upload flaw (CVE-2015-4133) leading to RCE. Claude and MCP Kali Server Automate a Lab Penetration Test
CVE (2)
MITRE ATT&CK (12)
Products (9)
Tools (11)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.