CVE-2014-1907

Severity: medium (CVSS 6.4 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 11.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2014-03-06 · updated 2026-06-17
Weakness: CWE-22

Description

Multiple directory traversal vulnerabilities in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allow remote attackers to (1) read arbitrary files via a .. (dot dot) in the s parameter to ls/rtmp_login.php or (2) delete arbitrary files via a .. (dot dot) in the s parameter to ls/rtmp_logout.php.

Affected products

videowhisper Live Streaming Integration Plugin: 4.27, 4.27.3
videowhisper Broadcast Live Video: through 4.27.4; 1.0.2, 2.0, 2.1, 2.2, 4.05, 4.07 (+2)

References

http://packetstormsecurity.com/files/125454
https://exchange.xforce.ibmcloud.com/vulnerabilities/91478
https://www.htbridge.com/advisory/HTB23199
http://packetstormsecurity.com/files/125454
https://exchange.xforce.ibmcloud.com/vulnerabilities/91478
https://www.htbridge.com/advisory/HTB23199

Get alerted when CVE-2014-1907 or the next vulnerability affects your stack