CVE-2014-4972 Gravity Upload Ajax <= 1.1 - Unrestricted File Upload
CriticalCVSS 9.8
EPSS 4.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Unrestricted file upload vulnerability in the Gravity Upload Ajax plugin 1.1 and earlier for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file under wp-content/uploads/gravity_forms.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ajax upload for gravity forms project ajax upload for gravity forms | <= 1.1 | No fix listed |
| wordpress gravity-file-ajax-upload-free(WordPress) | <= 1.1 | No fix listed |
References
- g0blin.co.uk exploit third-party-advisory
- wpvulndb.com third-party-advisory
- Wordfence Intelligence third-party-advisory
- www.cve.org