What’s Vulnerable › Vulnerabilities

CVE-2014-8877

• Severity: critical (CVSS 10.0 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 14.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2014-12-05 · updated 2026-06-17
• Weakness: CWE-94

Description

The alterSearchQuery function in lib/controllers/CmdownloadController.php in the CreativeMinds CM Downloads Manager plugin before 2.0.4 for WordPress allows remote attackers to execute arbitrary PHP code via the CMDsearch parameter to cmdownloads/, which is processed by the PHP create_function function.

Affected products

• Creative Minds Cm Download Manager: through 2.0.3; 2.0.0, 2.0.1, 2.0.2

References

• http://packetstormsecurity.com/files/129183/WordPress-CM-Download-Manager-2.0.0-Code-Injection.html
• http://www.itas.vn/news/code-injection-in-cm-download-manager-plugin-66.html
• http://www.securityfocus.com/archive/1/534037/100/0/threaded
• http://www.securityfocus.com/bid/71204
• https://downloadsmanager.cminds.com/release-notes/
• http://packetstormsecurity.com/files/129183/WordPress-CM-Download-Manager-2.0.0-Code-Injection.html
• http://www.itas.vn/news/code-injection-in-cm-download-manager-plugin-66.html
• http://www.securityfocus.com/archive/1/534037/100/0/threaded
• http://www.securityfocus.com/bid/71204
• https://downloadsmanager.cminds.com/release-notes/

Get alerted when CVE-2014-8877 or the next vulnerability affects your stack