Vulnerability Description
Unrestricted file upload vulnerability in lib_nonajax.php in the CformsII plugin 14.7 and earlier for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension via the cf_uploadfile2[] parameter, then accessing the file via a direct request to the file in the default upload directory.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Deliciousdays | Cformsii | <= 14.7 |
References
- http://www.securityfocus.com/archive/1/534349/30/0/threaded
- https://wordpress.org/plugins/cforms2/changelog/
- http://www.securityfocus.com/archive/1/534349/30/0/threaded
- https://wordpress.org/plugins/cforms2/changelog/
FAQ
What is CVE-2014-9473?
CVE-2014-9473 is a vulnerability with a CVSS score of 7.5 (HIGH). Unrestricted file upload vulnerability in lib_nonajax.php in the CformsII plugin 14.7 and earlier for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable...
How severe is CVE-2014-9473?
CVE-2014-9473 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2014-9473?
Check the references section above for vendor advisories and patch information. Affected products include: Deliciousdays Cformsii.