CVE-2014-9308
WP EasyCart <3.0.9 - RCE
Title source: llmDescription
Unrestricted file upload vulnerability in inc/amfphp/administration/banneruploaderscript.php in the WP EasyCart (aka WordPress Shopping Cart) plugin before 3.0.9 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in products/banners/.
Exploits (3)
exploitdb
WORKING POC
VERIFIED
by Metasploit · rubywebappsphp
https://www.exploit-db.com/exploits/36043
metasploit
WORKING POC
EXCELLENT
by Kacper Szurek, rastating · rubypocphp
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/wp_easycart_unrestricted_file_upload.rb
References (6)
Scores
EPSS
0.8290
EPSS Percentile
99.2%
Classification
Status
draft
Affected Products (1)
wpeasycart/wp_easycart
< 3.0.8
Timeline
Published
Jan 15, 2015
Tracked Since
Feb 18, 2026