CVE-2014-9735

· N/AModified

← All CVEs

CVSS v3.1

N/A

EPSS

75.70%

Published

Jun 30, 2015

Modified

May 6, 2026

Public PoC / Exploit (3)

All weaponized →

NucleiNuclei detection template TrickestTrickest PoC index Exploit-DBWordPress Plugin RevSlider 3.0.95 - Arbitrary File Upload / Execution (Metasploit)

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

The ThemePunch Slider Revolution (revslider) plugin before 3.0.96 for WordPress and Showbiz Pro plugin 1.7.1 and earlier for Wordpress does not properly restrict access to administrator AJAX functionality, which allows remote attackers to (1) upload and execute arbitrary files via an update_plugin action; (2) delete arbitrary sliders via a delete_slider action; and (3) create, (4) update, (5) import, or (6) export arbitrary sliders via unspecified vectors.

Weaknesses (CWE)

CWE-264

Affected Products (2)

themepunch · showbiz_provulnerable

themepunch · slider_revolutionvulnerable

References (14)

http://seclists.org/fulldisclosure/2014/Nov/78

Exploit

http://www.securityfocus.com/bid/71306

http://www.themepunch.com/products/old-revolution-slider-pre-4-2-vulnerabilty-explained/

Vendor Advisory

https://blog.sucuri.net/2014/12/revslider-vulnerability-leads-to-massive-wordpress-soaksoak-compromise.html