CVE-2014-5014

CRITICAL

WordPress Flash Uploader < 3.1.3 - Remote Code Execution via image_magic_path Parameter

Title source: llm

Description

The WordPress Flash Uploader plugin before 3.1.3 for WordPress allows remote attackers to execute arbitrary commands via vectors related to invalid characters in image_magic_path.

References (2)

Core 2

Core References

Release Notes x_refsource_confirm

https://wordpress.org/plugins/wordpress-flash-uploader/changelog/

Issue Tracking x_refsource_confirm

https://wordpress.org/support/topic/vulnerability-discovered-2/

Scores

CVSS v3 9.8

EPSS 0.0357

EPSS Percentile 87.9%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-77

Status published

Products (1)

tinywebgallery/wordpress_flash_uploader < 3.1.3

Published Apr 25, 2018

Tracked Since Feb 18, 2026