Vulnerability Details CVE-2014-9521
Unrestricted file upload vulnerability in uploadScript.php in InfiniteWP Admin Panel before 2.4.4, when the allWPFiles query parameter is set, allows remote attackers to execute arbitrary code by uploading a file with a double extension, then accessing it via a direct request to the file in the uploads directory, as demonstrated by the .php.swp filename.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.016
EPSS Ranking 81.1%
CVSS Severity
CVSS v2 Score 7.5
References
Products affected by CVE-2014-9521
-
cpe:2.3:a:infinitewp:infinitewp:-
-
cpe:2.3:a:infinitewp:infinitewp:2.4.2
-
cpe:2.3:a:infinitewp:infinitewp:2.4.3