Exploitation Summary
CVE-2014-9734 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 2 public exploits from researchers including Hugo Santiago.
AI-analyzed exploit summary This exploit demonstrates an arbitrary file download vulnerability in multiple WordPress themes by leveraging a path traversal flaw in the 'revslider_show_image' action parameter. The PoC allows unauthorized access to sensitive files like 'wp-config.php'.
Description
Directory traversal vulnerability in the Slider Revolution (revslider) plugin before 4.2 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the img parameter in a revslider_show_image action to wp-admin/admin-ajax.php.
Exploits (2)
This exploit demonstrates an arbitrary file download vulnerability in multiple WordPress themes by leveraging a path traversal flaw in the 'revslider_show_image' action parameter. The PoC allows unauthorized access to sensitive files like 'wp-config.php'.
The exploit demonstrates an arbitrary file download vulnerability in WordPress Slider Revolution Responsive plugin <= 4.1.4 by leveraging a path traversal flaw in the 'img' parameter of the 'revslider_show_image' action. The PoC URL directly accesses sensitive files like 'wp-config.php' without authentication.