CVE-2015-4133: Reflex Gallery Project Reflex Gallery

High severity, CVSS 7.5. EPSS: 62% chance of exploitation in the next 30 days.

Unrestricted file upload vulnerability in admin/scripts/FileUploader/php.php in the ReFlex Gallery plugin before 3.1.4 for WordPress allows remote attackers to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via a direct request to the file in uploads/ directory.

Affected products

• Reflex Gallery Project Reflex Gallery: up to and including 3.1.3

Published 2015-05-28. Last modified 2026-06-17.