CVE-2014-6446
50Vexday Risk Score
Patch soon. It has a working public exploit.
ssvc Attendepss 46%
from disclosure to weapon13 days
Published on NVDSep 26
1st PoC+13d
metasploitSep 25
exploitation probability
46%top 1% of all CVEs
observed exploitation
nono source reports it
3 public exploit(s)
The Infusionsoft Gravity Forms plugin 1.5.3 through 1.5.10 for WordPress does not properly restrict access, which allows remote attackers to upload arbitrary files and execute arbitrary PHP code via a request to utilities/code_generator.php.
Affected products
n/a · n/apublic PoCs found — 3
cve_referencepacketstormsecurity.com/files/131002/Wordpress-InfusionSoft-Shell-Upload.htmlunverifiedcve_referencewww.exploit-db.com/exploits/34925unverifiedexploitdbwww.exploit-db.com/exploits/34925unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.