CVE-2015-9499 — AI Deep Analysis Summary

Q: What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: Arbitrary PHP file upload via `admin-ajax.php`. 💥 **Consequences**: Unauthenticated Remote Code Execution (RCE). Attackers gain full control over the server.

Q: Who is affected? (Versions/Components)

📦 **Affected**: WordPress Showbiz Pro Plugin. 📉 **Version**: **1.7.1 and earlier**. 🌐 **Platform**: WordPress sites running this specific plugin.

Q: What can hackers do? (Privileges/Data)

👑 **Privileges**: **Unauthenticated** access. 💾 **Data**: Full server compromise. ⚡ **Action**: Execute arbitrary PHP code. 🔓 **Impact**: Complete system takeover.

Q: Is exploitation threshold high? (Auth/Config)

📉 **Threshold**: **LOW**. 🔑 **Auth**: **None required** (Unauthenticated). ⚙️ **Config**: Exploits `admin-ajax.php` endpoint directly. 🎯 **Ease**: Remote exploitation is straightforward.

Q: Is there a public Exp? (PoC/Wild Exploitation)

🔥 **Public Exp?**: **YES**. 📂 **Sources**: - Exploit-DB #35385 - GitHub PoC (nuclei-templates) - Metasploit module (wpsploit). 🌍 **Wild Exploitation**: High risk due to available tools.

Q: Is it fixed officially? (Patch/Mitigation)

🛠️ **Fix**: Update **Showbiz Pro** to version **> 1.7.1**. 📅 **Published**: Oct 2019. ✅ **Status**: Patch available for affected versions.

Q: Is it urgent? (Priority Suggestion)

🚨 **Urgency**: **CRITICAL**. 🔴 **Priority**: **P0**. ⚡ **Reason**: Unauthenticated RCE with public exploits. 🏃 **Action**: Patch or disable **IMMEDIATELY**.

Updated May 08, 2026

This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis →

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: Arbitrary PHP file upload via `admin-ajax.php`. <br>💥 **Consequences**: Unauthenticated Remote Code Execution (RCE). Attackers gain full control over the server.

Q2Root Cause? (CWE/Flaw)

🛡️ **Root Cause**: Insecure file upload handling. <br>🔍 **Flaw**: Allows `.php` file uploads without proper validation.…

Read full answer (login)

Q3Who is affected? (Versions/Components)

📦 **Affected**: WordPress Showbiz Pro Plugin. <br>📉 **Version**: **1.7.1 and earlier**. <br>🌐 **Platform**: WordPress sites running this specific plugin.

Q4What can hackers do? (Privileges/Data)

👑 **Privileges**: **Unauthenticated** access. <br>💾 **Data**: Full server compromise. <br>⚡ **Action**: Execute arbitrary PHP code. <br>🔓 **Impact**: Complete system takeover.

Q5Is exploitation threshold high? (Auth/Config)

📉 **Threshold**: **LOW**. <br>🔑 **Auth**: **None required** (Unauthenticated). <br>⚙️ **Config**: Exploits `admin-ajax.php` endpoint directly. <br>🎯 **Ease**: Remote exploitation is straightforward.

Q6Is there a public Exp? (PoC/Wild Exploitation)

🔥 **Public Exp?**: **YES**. <br>📂 **Sources**: <br>- Exploit-DB #35385 <br>- GitHub PoC (nuclei-templates) <br>- Metasploit module (wpsploit). <br>🌍 **Wild Exploitation**: High risk due to available tools.

Q7How to self-check? (Features/Scanning)

🔍 **Self-Check**: <br>1. Scan for `admin-ajax.php` upload vectors. <br>2. Check plugin version (`Showbiz Pro <= 1.7.1`). <br>3. Use Nuclei templates for detection. <br>4.…

Read full answer (login)

Q8Is it fixed officially? (Patch/Mitigation)

🛠️ **Fix**: Update **Showbiz Pro** to version **> 1.7.1**. <br>📅 **Published**: Oct 2019. <br>✅ **Status**: Patch available for affected versions.

Q9What if no patch? (Workaround)

🚧 **No Patch Workaround**: <br>1. **Disable** the plugin immediately. <br>2. **Block** `admin-ajax.php` upload permissions via WAF. <br>3. Restrict `.php` file uploads in `wp-config.php` or server config. <br>4.…

Read full answer (login)

Q10Is it urgent? (Priority Suggestion)

🚨 **Urgency**: **CRITICAL**. <br>🔴 **Priority**: **P0**. <br>⚡ **Reason**: Unauthenticated RCE with public exploits. <br>🏃 **Action**: Patch or disable **IMMEDIATELY**.

Continue exploring

Vulnerability detail Full AI analysis (login) n/a