CVE-2014-9735

Currently unrated

Key Information:

Vendor
Wordpress
Status
Showbiz Pro
Vendor
CVE Published:
30 June 2015

Summary

The ThemePunch Slider Revolution (revslider) plugin before 3.0.96 for WordPress and Showbiz Pro plugin 1.7.1 and earlier for Wordpress does not properly restrict access to administrator AJAX functionality, which allows remote attackers to (1) upload and execute arbitrary files via an update_plugin action; (2) delete arbitrary sliders via a delete_slider action; and (3) create, (4) update, (5) import, or (6) export arbitrary sliders via unspecified vectors.

References

https://wpvulndb.com/vulnerabilities/7954
x_refsource_MISC
https://blog.sucuri.net/2014/12/revslider-vulnerability-l...
x_refsource_MISC
http://www.themepunch.com/products/old-revolution-slider-...
x_refsource_CONFIRM

EPSS Score

89% chance of being exploited in the next 30 days.

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.