CVE-2014-1854

WordPress AdRotate Pro/FREE <3.9.5/3.9.4 - SQL Injection

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2014-1854. PoCs published by High-Tech Bridge SA.

AI-analyzed exploit summary The exploit demonstrates a SQL Injection vulnerability in AdRotate WordPress plugin via the 'track' HTTP GET parameter. The PoC uses a base64-encoded payload to extract the MySQL server version.

Description

SQL injection vulnerability in library/clicktracker.php in the AdRotate Pro plugin 3.9 through 3.9.5 and AdRotate Free plugin 3.9 through 3.9.4 for WordPress allows remote attackers to execute arbitrary SQL commands via the track parameter.

Exploits (1)

exploitdb WORKING POC VERIFIED

by High-Tech Bridge SA · textwebappsphp

https://www.exploit-db.com/exploits/31834

View Code ZIP pw:eip

The exploit demonstrates a SQL Injection vulnerability in AdRotate WordPress plugin via the 'track' HTTP GET parameter. The PoC uses a base64-encoded payload to extract the MySQL server version.

Classification

Working Poc 90%

Attack Type

Sqli

Complexity

Trivial

Reliability

Reliable

Target: AdRotate WordPress plugin 3.9.4 and prior

No auth needed

Prerequisites: Access to the target WordPress site with AdRotate plugin installed

MITRE ATT&CK

T1189 - Drive-by Compromise

devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (7)

Core 7

Core References

Third Party Advisory, VDB Entry vdb-entry x_refsource_xf

https://exchange.xforce.ibmcloud.com/vulnerabilities/91253

Vendor Advisory x_refsource_confirm

http://www.adrotateplugin.com/2014/01/adrotate-pro-3-9-6-and-adrotate-free-3-9-5

Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq

http://www.securityfocus.com/archive/1/531176/100/0/threaded

Exploit x_refsource_misc

https://www.htbridge.com/advisory/HTB23201

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/65709

Exploit exploit x_refsource_exploit-db

http://www.exploit-db.com/exploits/31834

Vendor Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/57079

Scores

EPSS 0.0537

EPSS Percentile 91.6%

Details

CWE

CWE-89

Status published

Products (6)

adrotateplugin/adrotate 3.9. (2 CPE variants)

adrotateplugin/adrotate 3.9.1 (2 CPE variants)

adrotateplugin/adrotate 3.9.2 (2 CPE variants)

adrotateplugin/adrotate 3.9.3 (2 CPE variants)

adrotateplugin/adrotate 3.9.4 (2 CPE variants)

adrotateplugin/adrotate 3.9.5

Published Feb 27, 2014

Tracked Since Feb 18, 2026