high7.5Public exploit code
CVE-2014-9473
Unrestricted file upload vulnerability in lib_nonajax.php in the CformsII plugin 14.7 and earlier for WordPress allows remote attackers to execute arbitrary co…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- WordPress Plugin Cforms 14.7 - Remote Code Execution2015-01-19 · webapps · php
Impact
Unrestricted file upload vulnerability in lib_nonajax.php in the CformsII plugin 14.7 and earlier for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension via the cf_uploadfile2[] parameter, then accessing the file via a direct request to the file in the default upload directory.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Deliciousdays | Cformsii | through 14.7 |