CVE-2015-1375: pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress does not properly restrict access to the upload functionality, which allows remote attackers to write to arbitrary files.

high Affects pixabay-images (WordPress plugin). Feed 2026.10.29.1, updated 2026-10-28; published 2015-01-28; advisory modified 2026-06-17.

pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress does not properly restrict access to the upload functionality, which allows remote attackers to write to arbitrary files.

Package: pixabay-images (WordPress plugin) WordPress
Affected versions: <=2.3
Fixed in: no fix recorded
Severity: high CVSS 7.5
Exploitation: not on CISA KEV · EPSS 12% (96.1th percentile)
Published: 2015-01-28
Source: nvd

References

CWE-264

NVD record pixabay-images (WordPress plugin) advisories

Am I affected?

Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# one-time install
pip install phpwarden

# then
phpwarden wordpress /var/www/html

Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.

Install docs How findings are ranked

Related advisories

CVE-2015-1376 medium pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress does not validate same package: pixabay-images (WordPress plugin)
CVE-2015-1365 medium Directory traversal vulnerability in pixabay-images.php in the Pixabay Images plugin befor same package: pixabay-images (WordPress plugin)
CVE-2015-1366 medium Cross-site scripting (XSS) vulnerability in pixabay-images.php in the Pixabay Images plugi same package: pixabay-images (WordPress plugin)
CVE-2014-9735 high The ThemePunch Slider Revolution (revslider) plugin before 3.0.96 for WordPress and Showbi same weakness: CWE-264
CVE-2015-2673 high The ec_ajax_update_option and ec_ajax_clear_all_taxrates functions in inc/admin/admin_ajax same weakness: CWE-264
CVE-2014-5337 medium The WordPress Mobile Pack plugin before 2.0.2 for WordPress does not properly restrict acc same weakness: CWE-264