Critical severity · published Feb 8, 2020
CVE-2014-8739
Unrestricted file upload vulnerability in server/php/UploadHandler.php in the jQuery File Upload Plugin 6.4.4 for jQuery, as used in the Creative Solutions Creative Contact Form…
9.8
CVSS
91.9%
EPSS
No
On KEV
Description
Unrestricted file upload vulnerability in server/php/UploadHandler.php in the jQuery File Upload Plugin 6.4.4 for jQuery, as used in the Creative Solutions Creative Contact Form (formerly Sexy Contact Form) before 1.0.0 for WordPress and before 2.0.1 for Joomla!, allows remote attackers to execute arbitrary code by uploading a PHP file with an PHP extension, then accessing it via a direct request to the file in files/, as exploited in the wild in October 2014.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)91.9% · higher than 100% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CC
Creative Contact Form · Creative-solutions
before 1.0.0; before 2.0.1 · source: NVD
JF
Jquery File Upload · Jquery File Upload Project
6.4.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-8739
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-8739
Broken Link
http://osvdb.org/show/osvdb/113669
Broken Link
http://osvdb.org/show/osvdb/113673
Mailing List
http://www.openwall.com/lists/oss-security/2014/11/11/4
Mailing List
http://www.openwall.com/lists/oss-security/2014/11/11/5
Mailing List
http://www.openwall.com/lists/oss-security/2014/11/13/3
Third Party Advisory
https://wordpress.org/plugins/sexy-contact-form/changelog/
More from Creative Contact Form
7.1
CVE-2025-52794
WordPress Creative Contact Form plugin <= 1.0.0 - Cross Site Request Forgery (CSRF) Vulnerability
5.3
CVE-2020-9364
An issue was discovered in helpers/mailer.php in the Creative Contact Form extension 4.6.2 before 2019-12-03 for Joomla!