CVE-2014-6446 Infusionsoft Gravity Forms Add-on 1.5.3 - 1.5.10 - Arbitrary File Upload
HighCVSS 7.5
EPSS 46.2%
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
The Infusionsoft Gravity Forms plugin 1.5.3 through 1.5.10 for WordPress does not properly restrict access, which allows remote attackers to upload arbitrary files and execute arbitrary PHP code via a request to utilities/code_generator.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| infusionsoft gravity forms project infusionsoft gravity forms | = 1.5.3 | No fix listed |
| infusionsoft gravity forms project infusionsoft gravity forms | = 1.5.4 | No fix listed |
| infusionsoft gravity forms project infusionsoft gravity forms | = 1.5.4.1 | No fix listed |
| infusionsoft gravity forms project infusionsoft gravity forms | = 1.5.4.2 | No fix listed |
| infusionsoft gravity forms project infusionsoft gravity forms | = 1.5.5 | No fix listed |
| infusionsoft gravity forms project infusionsoft gravity forms | = 1.5.6 | No fix listed |
| infusionsoft gravity forms project infusionsoft gravity forms | = 1.5.7 | No fix listed |
| infusionsoft gravity forms project infusionsoft gravity forms | = 1.5.7.1 | No fix listed |
| infusionsoft gravity forms project infusionsoft gravity forms | = 1.5.7.2 | No fix listed |
| infusionsoft gravity forms project infusionsoft gravity forms | = 1.5.8 | No fix listed |
| infusionsoft gravity forms project infusionsoft gravity forms | = 1.5.8.1 | No fix listed |
| infusionsoft gravity forms project infusionsoft gravity forms | = 1.5.9 | No fix listed |
| infusionsoft gravity forms project infusionsoft gravity forms | = 1.5.9.1 | No fix listed |
| infusionsoft gravity forms project infusionsoft gravity forms | = 1.5.9.2 | No fix listed |
| infusionsoft gravity forms project infusionsoft gravity forms | = 1.5.9.3 | No fix listed |
| infusionsoft gravity forms project infusionsoft gravity forms | = 1.5.9.4 | No fix listed |
| infusionsoft gravity forms project infusionsoft gravity forms | = 1.5.9.5 | No fix listed |
| infusionsoft gravity forms project infusionsoft gravity forms | = 1.5.10 | No fix listed |
| wordpress infusionsoft(WordPress) | >= 1.5.3, < 1.5.11 | 1.5.11 |
References
- 112171 vdb-entry
- packetstormsecurity.com exploit
- research.g0blin.co.uk exploit
- 34925 exploit
- wordpress.org patch
- Wordfence Intelligence third-party-advisory
- www.cve.org