CVE-2014-9735
EXPLOITED NUCLEIThemePunch Slider Revolution <3.0.96 & Showbiz Pro <1.7.1 - RCE
Title source: llmDescription
The ThemePunch Slider Revolution (revslider) plugin before 3.0.96 for WordPress and Showbiz Pro plugin 1.7.1 and earlier for Wordpress does not properly restrict access to administrator AJAX functionality, which allows remote attackers to (1) upload and execute arbitrary files via an update_plugin action; (2) delete arbitrary sliders via a delete_slider action; and (3) create, (4) update, (5) import, or (6) export arbitrary sliders via unspecified vectors.
Exploits (2)
exploitdb
WORKING POC
VERIFIED
by Metasploit · rubyremotephp
https://www.exploit-db.com/exploits/36957
metasploit
WORKING POC
EXCELLENT
by Simo Ben youssef · rubypocphp
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/wp_revslider_upload_execute.rb
Nuclei Templates (1)
WordPress RevSlider - Remote Code Execution via File Upload
HIGHby iamnoooob,pdresearch
References (7)
Scores
EPSS
0.8275
EPSS Percentile
99.2%
Details
VulnCheck KEV
2014-12-15
CWE
CWE-264
Status
published
Products (2)
themepunch/showbiz_pro
< 1.7.1
themepunch/slider_revolution
< 3.0.95
Published
Jun 30, 2015
Tracked Since
Feb 18, 2026