NetSight
IP …
high7.5Public exploit code

CVE-2014-6446

The Infusionsoft Gravity Forms plugin 1.5.3 through 1.5.10 for WordPress does not properly restrict access, which allows remote attackers to upload arbitrary f…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

The Infusionsoft Gravity Forms plugin 1.5.3 through 1.5.10 for WordPress does not properly restrict access, which allows remote attackers to upload arbitrary files and execute arbitrary PHP code via a request to utilities/code_generator.php.

Affected products

VendorProductAffected versions
Infusionsoft Gravity Forms ProjectInfusionsoft Gravity Forms
Versions 1.5.3, 1.5.4, 1.5.4.1, 1.5.4.2, 1.5.5, 1.5.6

Weakness classification

CWE-94

References