Is CVE-2015-10124 actively exploited?

No active exploitation of CVE-2015-10124 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2015-10124 be exploited remotely?

Yes. CVE-2015-10124 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2015-10124?

CVE-2015-10124 has a CVSS score of 9.8 (CRITICAL).

HOME VULNERABILITIESCVE-2015-10124

CRITICAL

CVE-2015-10124

CWE-89Published: October 2, 2023· Updated: Jun 17, 2026

9.8

CVSS v3.1

Official Description

A vulnerability was found in Most Popular Posts Widget Plugin up to 0.8 on WordPress. It has been classified as critical. Affected is the function add_views/show_views of the file functions.php. The manipulation leads to sql injection. It is possible to launch the attack remotely. Upgrading to version 0.9 is able to address this issue. The patch is identified as a99667d11ac8d320006909387b100e9a8b5c12e1. It is recommended to upgrade the affected component. VDB-241026 is the identifier assigned to this vulnerability.

NVD Source

Risk Analysis

The Most Popular Posts Widget Plugin for WordPress contains a SQL injection vulnerability in the add_views/show_views function. This critical flaw allows remote attackers to execute malicious database queries, warranting immediate attention due to its 9.8 CVSS rating.

There is no public exploit known for this issue, and it is not in the CISA KEV catalog.

Recommended Action

Users must upgrade the plugin to version 0.9 or later to apply the necessary security patch.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2015-10124 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 9.8.

From a weakness classification perspective (CWE-89): SQL injection vulnerabilities allow attackers to manipulate database queries, potentially exposing or modifying sensitive data.