CVE-2016-10959: Estatik

Medium severity, CVSS 6.5. EPSS: 1.1% chance of exploitation in the next 30 days.

The estatik plugin before 2.3.1 for WordPress has authenticated arbitrary file upload (exploitable with CSRF) via es_media_images[] to wp-admin/admin-ajax.php.

Affected products

• Estatik Estatik: before 2.3.1 (fixed in 2.3.1)

Published 2019-09-16. Last modified 2026-06-17.