CVE-2014-6446 EXPLOIT
7.5
HIGH · CVSS 2.0 · EPSS 46.2% (pctl 99)
Patch early
A public exploit exists.
Description
The Infusionsoft Gravity Forms plugin 1.5.3 through 1.5.10 for WordPress does not properly restrict access, which allows remote attackers to upload arbitrary files and execute arbitrary PHP code via a request to utilities/code_generator.php.
Scoring
| CVSS | 7.5 (HIGH, v2.0) |
|---|---|
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:P |
| EPSS | 46.17% — more likely to be exploited than 99% of all CVEs |
| Weakness | CWE-94 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2014-09-26 |
| Last modified | 2026-06-17 |
Affected (1)
| Vendor | Product |
|---|---|
| infusionsoft gravity forms project | infusionsoft gravity forms |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | WordPress Plugin InfusionSoft - Arbitrary File Upload (Metasploit) | 2014-10-09 |
References
- http://osvdb.org/show/osvdb/112171
- http://packetstormsecurity.com/files/131002/Wordpress-InfusionSoft-Shell-Upload.html
- http://research.g0blin.co.uk/cve-2014-6446/
- http://www.exploit-db.com/exploits/34925
- https://wordpress.org/plugins/infusionsoft/changelog/
- http://osvdb.org/show/osvdb/112171
- http://packetstormsecurity.com/files/131002/Wordpress-InfusionSoft-Shell-Upload.html
- http://research.g0blin.co.uk/cve-2014-6446/
- http://www.exploit-db.com/exploits/34925
- https://wordpress.org/plugins/infusionsoft/changelog/
→ the Explorer · watch your stack · NVD