Title: Arbitrary File Upload Vulnerability / Exploit?
Last modified: August 19, 2016

---

# Arbitrary File Upload Vulnerability / Exploit?

 *  [impressum](https://wordpress.org/support/users/impressum/)
 * (@impressum)
 * [17 years, 3 months ago](https://wordpress.org/support/topic/arbitrary-file-upload-vulnerability-exploit/)
 * Hello, folks.
    Here’s something from a total beginner with WordPress and no guru
   with coding and programming:
 * I’ve just installed WordPress 2.7.1 locally, based on a Wamp Server install in
   WinXp. Playing around in the settings, I noticed the following message in the
   Dashboard, under Incoming Links:
 * “**Buyacorp** linked here [saying](http://www.buayacorp.com/archivos/wordpress-arbitrary-file-upload-parte-2/),”
   Exploit [http://localhost/wp/?attachment_id=49](http://localhost/wp/?attachment_id=49)
   S …””
 * The word “saying” was a link (as I formated it above). The “[http://localhost…&#8221](http://localhost…&#8221);
   was plane text. Buyacorp, bolded. “wp” is the name of the folder where I installed
   WordPress locally.
 * I visited the link under “saying” and it’s spanish, which I don’t speak. I googled
   a bit and came up with [this](http://www.buayacorp.com/files/wordpress/wordpress-advisory.html).
   Here it states, the bug was fixed with the [changeset 5765](http://core.trac.wordpress.org/changeset/5765)
   but I quess it was not.
 * I quickly deconnected the Wamp Server. 🙂
 * Any suggestions? Any fixes?
    Many thanks.

Viewing 4 replies - 1 through 4 (of 4 total)

 *  [Len](https://wordpress.org/support/users/lenk/)
 * (@lenk)
 * [17 years, 3 months ago](https://wordpress.org/support/topic/arbitrary-file-upload-vulnerability-exploit/#post-1007931)
 * I have dozens of locals installs all containing various incoming links. They’re
   not referring to _your_ install. **Localhost** is exclusive to your machine. 
   🙂
 *  Thread Starter [impressum](https://wordpress.org/support/users/impressum/)
 * (@impressum)
 * [17 years, 3 months ago](https://wordpress.org/support/topic/arbitrary-file-upload-vulnerability-exploit/#post-1008061)
 * Thanks LenK for the response.
 * I don’t quite get it. I know localhost is refering strictly to my pc, but I still
   don’t see how the heck did the “incoming link” get there, in the Dashbord. Does
   WordPress.org put random dummy (incoming)links in their install files? Or did
   someone, somewhere, somehow link to my “local” blog and then it’s problem? 🙂
 *  [left_coaster](https://wordpress.org/support/users/left_coaster/)
 * (@left_coaster)
 * [16 years, 9 months ago](https://wordpress.org/support/topic/arbitrary-file-upload-vulnerability-exploit/#post-1008288)
 * Yeah, I’ve got the same thing happening on my install as well. I don’t think 
   it’s related to your computer specifically but perhaps WP is sharing links from
   other WP installs that point to [http://localhost/whatever/](http://localhost/whatever/)
   then shares them on every machine that has [http://localhost](http://localhost)
   as their domain.
 * Just a guess. Don’t think it’s something to be worried about from a security 
   standpoint but I think that some people may be concerned about the privacy issues
   involved. Perhaps they are using a local install of WP to keep a private diary
   or something…
 * Aaron
 *  [tusker](https://wordpress.org/support/users/tusker/)
 * (@tusker)
 * [16 years, 7 months ago](https://wordpress.org/support/topic/arbitrary-file-upload-vulnerability-exploit/#post-1008295)
 * I have a blog that is not on localhost anymore though I used it previously as
   a localhost website. Now it has a domain name with DNS and all. Why it still 
   shows links from localhost like [http://localhost/whatever?ref=](http://localhost/whatever?ref=)??
 * And they are there for 3 odd months now, and strangely the blog has so many backlinks
   even listed in google.

Viewing 4 replies - 1 through 4 (of 4 total)

The topic ‘Arbitrary File Upload Vulnerability / Exploit?’ is closed to new replies.

## Tags

 * [exploit](https://wordpress.org/support/topic-tag/exploit/)
 * [file upload](https://wordpress.org/support/topic-tag/file-upload/)
 * [risk](https://wordpress.org/support/topic-tag/risk/)

 * In: [Requests and Feedback](https://wordpress.org/support/forum/requests-and-feedback/)
 * 4 replies
 * 4 participants
 * Last reply from: [tusker](https://wordpress.org/support/users/tusker/)
 * Last activity: [16 years, 7 months ago](https://wordpress.org/support/topic/arbitrary-file-upload-vulnerability-exploit/#post-1008295)
 * Status: not resolved

## Topics

### Topics with no replies

### Non-support topics

### Resolved topics

### Unresolved topics

### All topics