CVE-2014-4972

Unrestricted file upload vulnerability in the Gravity Upload Ajax plugin 1.1 and earlier for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file under wp-content/uploads/gravity_forms.

Score

CVSS 3.0 9.8 Critical

Status

Modified - cve@mitre.org

Published

2018-01-08

Last modified

2024-08-06

Weaknesses

CWE-434

Affected products

• Ajax Upload For Gravity Forms (Ajax Upload For Gravity Forms Project)

References

• https://g0blin.co.uk/cve-2014-4972/
• https://wpvulndb.com/vulnerabilities/8232