CVE-2014-8949

The iMember360 plugin 3.8.012 through 3.9.001 for WordPress allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in the i4w_trace parameter. NOTE: this can be leveraged with CVE-2014-8948 to allow remote attackers to execute code. NOTE: it is not clear whether this issue itself crosses privileges.

• CWE-94

• http://osvdb.org/show/osvdb/106301
• http://packetstormsecurity.com/files/126324/WordPress-iMember360is-3.9.001-XSS-Disclosure-Code-Execution.htmlExploit
• http://seclists.org/fulldisclosure/2014/Apr/265Exploit
• http://secunia.com/advisories/58094
• http://www.exploit-db.com/exploits/33076Exploit
• http://osvdb.org/show/osvdb/106301
• http://packetstormsecurity.com/files/126324/WordPress-iMember360is-3.9.001-XSS-Disclosure-Code-Execution.htmlExploit
• http://seclists.org/fulldisclosure/2014/Apr/265Exploit
• http://secunia.com/advisories/58094
• http://www.exploit-db.com/exploits/33076Exploit

Published

Nov 16, 2014

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-8941Lexiglot through 2014-11-20 allows SQL injection via an admi…9.8
• CVE-2014-8942Lexiglot through 2014-11-20 allows CSRF.8.8
• CVE-2014-8943Lexiglot through 2014-11-20 allows SSRF via the admin.php?pa…8.8
• CVE-2014-8944Lexiglot through 2014-11-20 allows XSS (Reflected) via the u…5.4
• CVE-2014-8945admin.php?page=projects in Lexiglot through 2014-11-20 allow…9.8
• CVE-2014-8948Cross-site request forgery (CSRF) vulnerability in the iMemb…
• CVE-2014-8950Unspecified vulnerability in Check Point Security Gateway R7…
• CVE-2014-8951Unspecified vulnerability in Check Point Security Gateway R7…
• CVE-2014-8952Multiple unspecified vulnerabilities in Check Point Security…
• CVE-2014-8953Multiple cross-site request forgery (CSRF) vulnerabilities i…
• CVE-2014-8954Multiple cross-site scripting (XSS) vulnerabilities in phpSo…
• CVE-2014-8955Cross-site scripting (XSS) vulnerability in the Contact Form…