← back
CVE-2014-6446

CVE-2014-6446

EPSS 46.2%
The Infusionsoft Gravity Forms plugin 1.5.3 through 1.5.10 for WordPress does not properly restrict access, which allows remote attackers to upload arbitrary files and execute arbitrary PHP code via a request to utilities/code_generator.php.
Affected products
n/a · n/a
public PoCs found — 3
cve_referencepacketstormsecurity.com/files/131002/Wordpress-InfusionSoft-Shell-Upload.htmlunverifiedcve_referencewww.exploit-db.com/exploits/34925unverifiedexploitdbwww.exploit-db.com/exploits/34925unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
http://osvdb.org/show/osvdb/112171http://packetstormsecurity.com/files/131002/Wordpress-InfusionSoft-Shell-Upload.htmlhttp://research.g0blin.co.uk/cve-2014-6446/https://wordpress.org/plugins/infusionsoft/changelog/http://www.exploit-db.com/exploits/34925