WordPress CVEs

Description

The Infusionsoft Gravity Forms plugin 1.5.3 through 1.5.10 for WordPress does not properly restrict access, which allows remote attackers to upload arbitrary files and execute arbitrary PHP code via a request to utilities/code_generator.php.

Affected WordPress components

• infusionsoft Plugin · infusionsoft
  Confirmed match Homeless
  Versions not specified
  View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• n/a n/a — Versions not specified
• infusionsoft_gravity_forms_project infusionsoft_gravity_forms — Version 1.5.3
• infusionsoft_gravity_forms_project infusionsoft_gravity_forms — Version 1.5.4
• infusionsoft_gravity_forms_project infusionsoft_gravity_forms — Version 1.5.4.1
• infusionsoft_gravity_forms_project infusionsoft_gravity_forms — Version 1.5.4.2
• infusionsoft_gravity_forms_project infusionsoft_gravity_forms — Version 1.5.5
• infusionsoft_gravity_forms_project infusionsoft_gravity_forms — Version 1.5.6
• infusionsoft_gravity_forms_project infusionsoft_gravity_forms — Version 1.5.7
• infusionsoft_gravity_forms_project infusionsoft_gravity_forms — Version 1.5.7.1
• infusionsoft_gravity_forms_project infusionsoft_gravity_forms — Version 1.5.7.2
• infusionsoft_gravity_forms_project infusionsoft_gravity_forms — Version 1.5.8
• infusionsoft_gravity_forms_project infusionsoft_gravity_forms — Version 1.5.8.1
• infusionsoft_gravity_forms_project infusionsoft_gravity_forms — Version 1.5.9
• infusionsoft_gravity_forms_project infusionsoft_gravity_forms — Version 1.5.9.1
• infusionsoft_gravity_forms_project infusionsoft_gravity_forms — Version 1.5.9.2
• infusionsoft_gravity_forms_project infusionsoft_gravity_forms — Version 1.5.9.3
• infusionsoft_gravity_forms_project infusionsoft_gravity_forms — Version 1.5.9.4
• infusionsoft_gravity_forms_project infusionsoft_gravity_forms — Version 1.5.9.5
• infusionsoft_gravity_forms_project infusionsoft_gravity_forms — Version 1.5.10

References

• osvdb.org http://osvdb.org/show/osvdb/112171
• packetstormsecurity.com http://packetstormsecurity.com/files/131002/Wordpress-InfusionSoft-Shell-Upload.html Exploit
• research.g0blin.co.uk http://research.g0blin.co.uk/cve-2014-6446/ Exploit
• www.exploit-db.com http://www.exploit-db.com/exploits/34925 Exploit
• wordpress.org https://wordpress.org/plugins/infusionsoft/changelog/ Patch
• nvd.nist.gov Official NVD record