On this page
Atomicorp WAF Rule 382238
Rule Summary
- Rule ID: 382238
- Status: Active
- Alert message: Atomicorp.com WAF Rules - Virtual Just In Time Patch: PHP file execution in uploads directory denied
- Observed CWEs: CWE-20 (2), CWE-22 (1), CWE-98 (1), CWE-178 (1), CWE-284 (1), CWE-287 (1), CWE-306 (1), CWE-352 (1), CWE-434 (30), CWE-862 (1)
- Revision: 2
- Rule severity: Critical (2)
- Phase: 2 (request body)
- Request surfaces: Request filename
- Rule action: deny
- HTTP status: 403
- Logging: log, auditlog
Description
This rule detects behavior identified by its current alert as “Virtual Just In Time Patch: PHP file execution in uploads directory denied” in the request filename. It evaluates during the request body phase and denies matching traffic with HTTP status 403.
Selected Related CVEs
This is a selected list of documented research observations, not an exhaustive coverage matrix. Absence of a CVE does not imply absence of protection.
| CVE | Vulnerability | Product | CVSS | Severity |
|---|---|---|---|---|
| CVE-2012-10026 | WordPress Asset-Manager PHP File Upload Vulnerability | asset-manager | 10.0 (v4.0) | Critical |
| CVE-2020-24186 | WordPress wpDiscuz Unauthenticated File Upload Vulnerability | wpdiscuz | 10.0 (v3.1) | Critical |
| CVE-2024-56064 | WP SuperBackup <= 2.3.3 - Unauthenticated Arbitrary File Upload to RCE | indeed-wp-superbackup | 10.0 (v3.1) | Critical |
| CVE-2025-47577 | TI WooCommerce Wishlist <= 2.9.2 - Arbitrary File Upload | ti-woocommerce-wishlist | 10.0 (v3.1) | Critical |
| CVE-2015-10135 | WordPress WPshop eCommerce Arbitrary File Upload Vulnerability | wpshop 2 | 9.8 (v3.1) | Critical |
| CVE-2015-10137 | Wordpress N-Media Website Contact Form Upload Vulnerability | website contact form with file upload | 9.8 (v3.1) | Critical |
| CVE-2016-1209 | WordPress Ninja Forms Unauthenticated File Upload | ninja forms | 9.8 (v3.0) | Critical |
| CVE-2016-15042 | WordPress Frontend File Manager < 4.0 & N-Media Post Frontend < 1.1 - Arbitrary File Upload | frontend file manager | 9.8 (v3.1) | Critical |
| CVE-2020-12832 | WordPress Simple File List - Path Traversal | Simple File List WordPress Plugin | 9.8 (v3.1) | Critical |
| CVE-2020-36847 | WordPress Simple File List Unauthenticated Remote Code Execution | simple file list | 9.8 (v3.1) | Critical |
| CVE-2020-36849 | WordPress AIT CSV Import Export Unauthenticated Remote Code Execution | csv import / export | 9.8 (v3.1) | Critical |
| CVE-2021-24212 | WooCommerce Help Scout - Arbitrary File Upload | help scout | 9.8 (v3.1) | Critical |
| CVE-2021-24284 | WordPress Kaswara Modern VC Addons <=3.0.1 - Arbitrary File Upload | kaswara | 9.8 (v3.1) | Critical |
| CVE-2021-24499 | WordPress Workreap - Remote Code Execution | workreap | 9.8 (v3.1) | Critical |
| CVE-2021-34624 | WordPress ProfilePress 3.0-3.1.3 - Arbitrary File Upload | profilepress | 9.8 (v3.1) | Critical |
| CVE-2022-1574 | WordPress HTML2WP <=1.0.0 - Arbitrary File Upload | html2wp | 9.8 (v3.1) | Critical |
| CVE-2022-1952 | WordPress eaSYNC Booking <1.1.16 - Arbitrary File Upload | free booking plugin for hotels, restaurant and car rental | 9.8 (v3.1) | Critical |
| CVE-2022-3982 | WordPress Booking Calendar <3.2.2 - Arbitrary File Upload | booking calendar | 9.8 (v3.1) | Critical |
| CVE-2022-4328 | WooCommerce Checkout Field Manager < 18.0 - Arbitrary File Upload | woocommerce checkout field manager | 9.8 (v3.1) | Critical |
| CVE-2023-51409 | Jordy Meow AI Engine - Unrestricted File Upload | ai engine | 9.8 (v3.1) | Critical |
| CVE-2023-5360 | WordPress Royal Elementor Addons Plugin <= 1.3.78 - Arbitrary File Upload | royal elementor addons | 9.8 (v3.1) | Critical |
| CVE-2024-4620 | ArForms < 6.6 - Remote Code Execution | arforms | 9.8 (v3.1) | Critical |
| CVE-2024-5084 | WordPress Hash Form Plugin RCE | hash form | 9.8 (v3.1) | Critical |
| CVE-2024-8425 | WooCommerce Ultimate Gift Card ≤ 2.6.0 - Arbitrary File Upload | woocommerce ultimate gift card | 9.8 (v3.1) | Critical |
| CVE-2024-8856 | WordPress WP Time Capsule Arbitrary File Upload to RCE | backup and staging by wp time capsule | 9.8 (v3.1) | Critical |
| CVE-2025-34085 | WordPress Simple File List <=4.2.2 - Remote Code Execution | - | 9.8 | Critical |
| CVE-2025-6058 | WPBookit <= 1.0.4 - Unauthenticated Arbitrary File Upload | wpbookit | 9.8 (v3.1) | Critical |
| CVE-2025-7441 | WordPress StoryChief Plugin Unauthenticated RCE | StoryChief | 9.8 (v3.1) | Critical |
| CVE-2026-0740 | Ninja Forms File Uploads <= 3.3.26 - Arbitrary File Upload | ninja forms file uploads | 9.8 (v3.1) | Critical |
| CVE-2026-85097 | Bricksforge WordPress Plugin <=3.1.8.9 - Unauthenticated Arbitrary File Upload | Bricksforge | 9.8 (v3.1) | Critical |
| CVE-2014-9312 | WordPress Photo Gallery Unrestricted File Upload | photo gallery | 8.8 (v3.0) | High |
| CVE-2015-10144 | WordPress Responsive Thumbnail Slider Arbitrary File Upload | thumbnail carousel slider | 8.8 (v3.1) | High |
| CVE-2021-24347 | Wordpress Plugin SP Project and Document - Authenticated Remote Code Execution | sp project & document manager | 8.8 (v3.1) | High |
| CVE-2021-25094 | Tatsu Wordpress Plugin RCE | tatsu | 8.1 (v3.1) | High |
| CVE-2025-48157 | WordPress Formality Plugin <= 1.5.9 - Local File Inclusion | Formality | 8.1 (v3.1) | High |
| CVE-2026-5718 | Drag and Drop Multiple File Upload - CF7 <= 1.3.9.6 - Remote Code Execution | drag-and-drop-multiple-file-upload-contact-form-7 | 8.1 (v3.1) | High |
| CVE-2014-4725 | Wordpress MailPoet Newsletters (wysija-newsletters) Unauthenticated File Upload | mailpoet newsletters | 7.5 (v2.0) | High |
| CVE-2015-4133 | Wordpress Reflex Gallery Upload Vulnerability | reflex gallery | 7.5 (v2.0) | High |
| CVE-2021-24145 | Wordpress Plugin Modern Events Calendar - Authenticated Remote Code Execution | modern events calendar lite | 7.2 (v3.1) | High |
| CVE-2021-24155 | Wordpress Plugin Backup Guard - Authenticated Remote Code Execution | backup guard | 7.2 (v3.1) | High |
| CVE-2021-39352 | Wordpress Plugin Catch Themes Demo Import RCE | catch themes demo import | 7.2 (v3.1) | High |
| CVE-2026-13158 | Everest Toolkit <= 1.2.3 - Admin+ Arbitrary File Upload | Everest Toolkit | 7.2 (v3.1) | High |
| CVE-2014-5460 | Wordpress SlideShow Gallery Authenticated File Upload | tibulant slideshow gallery | 6.5 (v2.0) | Medium |
| CVE-2025-14545 | YML for Yandex Market < 5.0.26 - Shop Manager+ RCE via Feed Generation | YML for Yandex Market | 6.5 (v3.1) | Medium |
| CVE-2015-1376 | WordPress Pixabay Images PHP Code Upload | pixabay images | 4.0 (v2.0) | Medium |
Observed CWEs
These CWEs are recorded on published CVEs in the selected observations associated with this rule. They are observational relationships, not a claim that the rule universally blocks every vulnerability assigned to a CWE.