CVE-2014-8603

Severity: medium (CVSS 6.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 6.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2015-06-10 · updated 2026-06-17
Weakness: CWE-20

Description

cloner.functions.php in the XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! allows remote administrators to execute arbitrary code via shell metacharacters in the (1) file name when creating a backup or vectors related to the (2) $_CONFIG[tarpath], (3) $exclude, (4) $_CONFIG['tarcompress'], (5) $_CONFIG['filename'], (6) $_CONFIG['exfile_tar'], (7) $_CONFIG[sqldump], (8) $_CONFIG['mysql_host'], (9) $_CONFIG['mysql_pass'], (10) $_CONFIG['mysql_user'], (11) $database_name, or (12) $sqlfile variable.

Affected products

Xcloner: 3.1.1, 3.5.1

References

http://www.vapid.dhs.org/advisories/wordpress/plugins/Xcloner-v3.1.1/
http://www.vapid.dhs.org/advisory.php?v=110
http://www.vapid.dhs.org/advisories/wordpress/plugins/Xcloner-v3.1.1/
http://www.vapid.dhs.org/advisory.php?v=110

Get alerted when CVE-2014-8603 or the next vulnerability affects your stack