CVE-2014-9734: themepunch slider_revolution
Vulnerability summary
CVE-2014-9734 is a high (CVSS 7.5) vulnerability in themepunch slider_revolution. EPSS estimates a 20.49% chance of exploitation in the next 30 days, higher than 97.5% of scored vulnerabilities. 5 public exploits are recorded.
Public exploit (exploit-database, 30-03-2015)
Source freshness unavailable
How is this decided?Timeline
- 30-06-2015PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
Directory traversal vulnerability in the Slider Revolution (revslider) plugin before 4.2 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the img parameter in a revslider_show_image action to wp-admin/admin-ajax.php.
CVSS metrics
2 scores · 2 sources · 2 versionsEPSS trend
Probability
20.49%
Chance of exploitation in the next 30 days
Percentile
98%
Versus all other CVEs
30-day change
No change 0.00 pp
From 20.49% on 11-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
5 foundExploit Reference (blog.sucuri.net)
Maturity: unknown
Exploit Reference (blog.sucuri.net)
Maturity: unknown
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Themepunch1 product
- slider_revolution≤ 4.1.4
Wordpress1 product
- revslider≤ 4.1.4 (fixed in 4.2)
2 vendors · 2 products
References
8 links- marketblog.envato.com/news/affected-themes/X Refsource MISC
- blog.sucuri.net/2014/09/slider-revolution-plugin-critical-vulnerability-being-exploited.htmlX Refsource CONFIRMExploit
- marketblog.envato.com/news/plugin-vulnerability/X Refsource MISC