CVE-2014-8739 in the critical feed json
jQuery File Upload Plugin Unrestricted file upload vulnerability
published 2020-02-08 6 y ago modified 2026-06-17 4 mo ago also EUVD-2022-5670 , GHSA-wxg6-f773-g2f7
- cvss
- 9.8
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 91.9%
- EPSS 91.9% chance of exploitation in 30 days, percentile 99.8%
- public exploits
- 3
- Metasploit, Exploit-DB, plus a Nuclei check
Summary
Unrestricted file upload vulnerability in server/php/UploadHandler.php in the jQuery File Upload Plugin 6.4.4 for jQuery, as used in the Creative Solutions Creative Contact Form (formerly Sexy Contact Form) before 1.0.0 for WordPress and before 2.0.1 for Joomla!, allows remote attackers to execute arbitrary code by uploading a PHP file with an PHP extension, then accessing it via a direct request to the file in files/, as exploited in the wild in October 2014.
Patch / fix
- creative-solutions creative_contact_form 1.0.0, 2.0.1
Timeline
- First public exploit (Metasploit exploit/unix/webapp/wp_creativecontactform_file_upload)
- Published
Exploit prediction
91.86% chance of exploitation in the next 30 days, higher than 99.8% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- Metasploit exploit/unix/webapp/wp_creativecontactform_file_upload Wordpress Creative Contact Form Upload Vulnerability metasploit exploit, excellent rank, 2014-10-22
- EDB-36811 WordPress Plugin Creative Contact Form - Arbitrary File Upload (Metasploit) remote, 2015-04-21
- EDB-35057 WordPress Plugin 0.9.7 / Joomla! Component 2.0.0 Creative Contact Form - Arbitrary File Upload webapps, 2014-10-25
- Nuclei template WordPress Sexy Contact Form (<= 0.9.7) - Arbitrary File Upload nuclei detection template
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | blueimp/jquery-file-upload | 1 listed version |
no fix listed |
Classification
- Weakness
-
- CWE-434 Unrestricted Upload of File with Dangerous Type
- Technology feeds
References
-
exploit-db.com
/exploits/35057/
exploit, third-party-advisory, vdb-entry
-
exploit-db.com
/exploits/36811/
exploit, third-party-advisory, vdb-entry
-
openwall.com
/lists/oss-security/2014/11/11/4
web, mailing-list, third-party-advisory
-
openwall.com
/lists/oss-security/2014/11/11/5
web, mailing-list, third-party-advisory
-
openwall.com
/lists/oss-security/2014/11/13/3
web, mailing-list, third-party-advisory
-
wordpress.org
/plugins/sexy-contact-form/changelog/
third-party-advisory
-
osvdb.org
/show/osvdb/113669
web, broken-link
-
osvdb.org
/show/osvdb/113673
web, broken-link
-
nvd.nist.gov
/vuln/detail/CVE-2014-8739
advisory
-
wordpress.org
/plugins/sexy-contact-form/changelog
web
-
exploit-db.com
/exploits/35057
web
-
exploit-db.com
/exploits/36811
web
Sources
- CVE List CVE-2014-8739
- GitHub Advisory GHSA-wxg6-f773-g2f7
- NVD CVE-2014-8739
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.