$ cve CVE-2014-8739 JSON

CVE-2014-8739 EXPLOIT

9.8

CRITICAL · CVSS 3.1 · EPSS 91.7% (pctl 100)

Patch early

A public exploit exists.

Description

Unrestricted file upload vulnerability in server/php/UploadHandler.php in the jQuery File Upload Plugin 6.4.4 for jQuery, as used in the Creative Solutions Creative Contact Form (formerly Sexy Contact Form) before 1.0.0 for WordPress and before 2.0.1 for Joomla!, allows remote attackers to execute arbitrary code by uploading a PHP file with an PHP extension, then accessing it via a direct request to the file in files/, as exploited in the wild in October 2014.

Scoring

CVSS	9.8 (CRITICAL, v3.1)
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS	91.66% — more likely to be exploited than 100% of all CVEs
Weakness	CWE-434
On CISA KEV	no
Public exploit	yes
Published	2020-02-08
Last modified	2026-06-17

Affected (2)

Vendor	Product
creative-solutions	creative contact form
jquery file upload project	jquery file upload

Public exploits

Source	Title	Date
exploit-db	WordPress Plugin Creative Contact Form - Arbitrary File Upload (Metasploit)	2015-04-21
exploit-db	WordPress Plugin 0.9.7 / Joomla! Component 2.0.0 Creative Contact Form - Arbitrary File Upload	2014-10-25

References

→ the Explorer · watch your stack · NVD