Remote Code Execution Vulnerability in XCloner Plugin for WordPress
CVE-2014-8603

Currently unrated

Key Information:

Vendor
Wordpress
Status
Xcloner
Vendor
CVE Published:
10 June 2015

Summary

The XCloner plugin versions 3.1.1 and 3.5.1 have a vulnerability that allows remote administrators to execute arbitrary code. This is achieved through the manipulation of various configuration variables during backup creation, including the file name and paths related to SQL dumps and compression settings. The flaw is primarily due to improper sanitization of inputs which may include shell metacharacters, thereby posing a significant risk to WordPress sites utilizing this plugin.

References

http://www.vapid.dhs.org/advisories/wordpress/plugins/Xcl...
x_refsource_MISC
http://www.vapid.dhs.org/advisory.php?v=110
x_refsource_MISC

EPSS Score

6% chance of being exploited in the next 30 days.

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.