Exploitation Summary
EIP tracks 1 public exploit for CVE-2014-8801. PoCs published by Kacper Szurek.
AI-analyzed exploit summary This exploit demonstrates a path traversal vulnerability in Paid Memberships Pro 1.7.14.2, allowing unauthorized access to sensitive files like wp-config.php via a crafted URL. The issue arises due to improper privilege checks and unescaped user input in getfile.php.
Description
Directory traversal vulnerability in services/getfile.php in the Paid Memberships Pro plugin before 1.7.15 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the QUERY_STRING in a getfile action to wp-admin/admin-ajax.php.
Exploits (1)
This exploit demonstrates a path traversal vulnerability in Paid Memberships Pro 1.7.14.2, allowing unauthorized access to sensitive files like wp-config.php via a crafted URL. The issue arises due to improper privilege checks and unescaped user input in getfile.php.