CVE•Published 2025-07-19•1 article on news•7 live references•NVD data

CVE-2016-15043

Vulnerability data via CVEDB (Shodan)

CVSS v3.1

9.8

CRITICAL

EPSS percentile

Exploit Prediction Scoring System · top 5% of all CVEs

Description

The WP Mobile Detector plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in resize.php file in versions up to, and including, 3.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.

Timeline

Published 2025-07-19

External references

NVD MITRE Exploit-DB GitHub PoC Sploitus trickest/cve VulnCheck

Search for exposed instances

Shodan + Censys queries derived from NVD's CPE data. The vuln tag catches assets Shodan has explicitly linked to this CVE; the product / banner fingerprints find exposed instances even when the vuln tag was never applied (which is common).

Shodan · vuln tag0 hosts

vuln:CVE-2016-15043

Hosts Shodan has explicitly fingerprinted as vulnerable.

Shodan · WP plugin path

http.html:"/wp-content/plugins/wp-mobile-detector/"

Matches any site loading the "wp-mobile-detector" plugin — doesn't rely on Shodan's vuln tag.

Shodan · product

product:"Wp Mobile Detector Project Wp Mobile Detector"

All exposed Wp Mobile Detector Project Wp Mobile Detector instances — cross-reference with the CVE's affected-version range.

Shodan · banner/body mention

http.html:"Wp Mobile Detector"

HTTP body or banner mentions "Wp Mobile Detector" — catches deploys Shodan didn't identify as a product.