CVE-2014-5337 json
The WordPress Mobile Pack plugin before 2.0.2 for WordPress does not properly restrict access to password protected posts, which allows rem…
published 2014-08-29 12 y ago modified 2026-06-17 4 mo ago also EUVD-2014-5226
- cvss
- 5.0
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 17.0%
- EPSS 17.0% chance of exploitation in 30 days, percentile 97%
- public exploits
- 1
- Metasploit
Summary
The WordPress Mobile Pack plugin before 2.0.2 for WordPress does not properly restrict access to password protected posts, which allows remote attackers to obtain sensitive information via an exportarticles action to export/content.php.
Patch / fix
Exploit prediction
16.99% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- Metasploit auxiliary/scanner/http/wp_mobile_pack_info_disclosure WordPress Mobile Pack Information Disclosure Vulnerability metasploit auxiliary, normal rank
- security.dxw.com https://security.dxw.com/advisories/information-disclosure-vulnerability-in-wordpress-mobile-pack-allows-anybody-to-read-password-protected-posts/ referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
Classification
- Weakness
-
- CWE-264 Permissions, Privileges, and Access Controls
- Technology feeds
References
Sources
- CVE List CVE-2014-5337
- NVD CVE-2014-5337
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.