CVE-2012-10064: Omnilogic Omni Secure Files

Critical severity, CVSS 9.3. EPSS: 0.7% chance of exploitation in the next 30 days.

Omni Secure Files plugin versions prior to 0.1.14 contain an arbitrary file upload vulnerability in the bundled plupload example endpoint. The /wp-content/plugins/omni-secure-files/plupload/examples/upload.php handler allows unauthenticated uploads without enforcing safe file type restrictions, enabling an attacker to place attacker-controlled files under the plugin's uploads directory. This can lead to remote code execution if a server-executable file type is uploaded and subsequently accessed.

Affected products

• Omnilogic Omni Secure Files: before 0.1.14 (fixed in 0.1.14)

Published 2026-01-16. Last modified 2026-06-16.