High severity8.8NVD Advisory· Published Jul 22, 2025· Updated Jun 17, 2026

CVE-2015-10140

Description

The Ajax Load More plugin before 2.8.1.2 does not have authorisation in some of its AJAX actions, allowing any authenticated users, such as subscriber, to upload and delete arbitrary files.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Connekthq/Ajax Load More
cpe:2.3:a:connekthq:ajax_load_more:*:*:*:*:*:wordpress:*:*
Range: <2.8.1.2
Ajax Load More plugin/Ajax Load More plugindescription
WordPress/Ajax Load Morellm-fuzzy
Range: <2.8.1.2
Package: https://wordpress.org/plugins/ajax-load-more

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/9f0c926e-0609-4c89-a724-88e16bcfa82anvdExploitThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.572
epss	0.001
exploit	0.030
kev	0.000
patch	0.000
ransomware	0.000