CVE-2014-9013 WP Marketplace – Complete Shopping Cart / eCommerce Solution <= 2.4.0 - Arbitrary File Download
HighCVSS 8.8
EPSS 45.9%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
The ajaxinit function in wpmarketplace/libs/cart.php in the WP Marketplace plugin 2.4.0 for WordPress allows remote authenticated users to create arbitrary users and gain admin privileges via a request to wpmp_pp_ajax_call with an execution target of wp_insert_user.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| wordpress wpmarketplace(WordPress) | < 2.4.1 | 2.4.1 |
| wpmarketplace project wpmarketplace | = 2.4.0 | No fix listed |
References
- Wordfence Intelligence third-party-advisory
- www.cve.org
- www.exploit-db.com third-party-advisory vdb-entry