CVE-2014-9735
Last modified
CVE-2014-9735 is a vulnerability of currently unknown severity. The ThemePunch Slider Revolution (revslider) plugin before 3.0.96 for WordPress and Showbiz Pro plugin 1.7.1 and earlier for Wordpress does not properly restrict access to administrator AJAX functionality, which allows remote attackers to (1) upload and execute arbitrary files via an update_plugin action; (2) delete arbitrary sliders via a delete_slider action; and (3) create, (4) update, (5) import, or (6) export arbitrary sliders via unspecified vectors.. EPSS estimates a 75.26% chance of exploitation in the next 30 days.
Description
The ThemePunch Slider Revolution (revslider) plugin before 3.0.96 for WordPress and Showbiz Pro plugin 1.7.1 and earlier for Wordpress does not properly restrict access to administrator AJAX functionality, which allows remote attackers to (1) upload and execute arbitrary files via an update_plugin action; (2) delete arbitrary sliders via a delete_slider action; and (3) create, (4) update, (5) import, or (6) export arbitrary sliders via unspecified vectors.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Themepunch | Showbiz Pro | <= 1.7.1 |
| Themepunch | Slider Revolution | <= 3.0.95 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2014-9735?
How severe is CVE-2014-9735?
How do I fix CVE-2014-9735?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2014
- CVE-2014-9729The udf_read_inode function in fs/udf/inode.c in the Linux k…
- CVE-2014-9730The udf_pc_to_char function in fs/udf/symlink.c in the Linux…
- CVE-2014-9731The UDF filesystem implementation in the Linux kernel before…
- CVE-2014-9732The cabd_extract function in cabd.c in libmspack before 0.5 …
- CVE-2014-9733nw.js before 0.11.5 can simulate user input events in a norm…
- CVE-2014-9734Directory traversal vulnerability in the Slider Revolution (…
- CVE-2014-9736GE Healthcare Centricity Clinical Archive Audit Trail Reposi…
- CVE-2014-9737Open redirect vulnerability in the Language Switcher Dropdow…
- CVE-2014-9738Multiple cross-site scripting (XSS) vulnerabilities in the T…
- CVE-2014-9739Cross-site scripting (XSS) vulnerability in the Node Field m…
- CVE-2014-9740Cross-site scripting (XSS) vulnerability in the Rules Link m…
- CVE-2014-9741Multiple cross-site scripting (XSS) vulnerabilities in ESRI …
Are you affected by CVE-2014-9735?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST