CVE-2015-10140 Ajax Load More < 2.8.1.2 - Subscriber+ File Upload & Deletion
Authenticated subscribers can upload and delete arbitrary files due to missing authorization in AJAX actions, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2015-10140?
CVE-2015-10140 is a high-severity missing authorization vulnerability in Unknown Ajax Load More, published on 22 Jul 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The Ajax Load More plugin before 2.8.1.2 does not have authorisation in some of its AJAX actions, allowing any authenticated users, such as subscriber, to upload and delete arbitrary files.
Weakness: CWE-862
Which versions are affected by CVE-2015-10140?
It affects 1 product.
Products include Connekthq Ajax Load More.
How do I fix CVE-2015-10140?
No fix has been published for CVE-2015-10140 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2015-10140 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2015-10140 exists.
Public exploit code: 1 Metasploit module.
Other vulnerabilities in Unknown Ajax Load More
- CVE-2022-2433 WordPress Infinite Scroll – Ajax Load More <= 5.5.3 - Cross-Site Request Forgery to PHAR Deserialization
- CVE-2021-24140 Ajax Load More < 5.3.2 - Authenticated SQL Injection
- CVE-2025-47630 WordPress Ajax Load More plugin <= 7.3.1.2 - Cross Site Scripting (XSS) Vulnerability
- CVE-2023-50874 WordPress Ajax Load More Plugin <= 6.1.0.1 is vulnerable to Cross Site Scripting (XSS)
- CVE-2024-8505 Cross-site scripting in Ajax Load More – Infinite Scroll, Load More, & Lazy Load
Sources
Also known as GHSA-3jhf-hf27-8fww.