9.8

CVE-2014-9735: themepunch showbiz_pro

Modified
Published 30-06-2015Last modified 06-08-2024

Vulnerability summary

CVE-2014-9735 is a critical (CVSS 9.8) vulnerability in themepunch showbiz_pro. EPSS estimates a 75.56% chance of exploitation in the next 30 days, higher than 99.5% of scored vulnerabilities. 5 public exploits are recorded.

Priority
Prioritiseweaponized exploit

Weaponized exploit (exploit-database, 08-05-2015)

Source freshness unavailable

How is this decided?
CVSS score
9.8/10
010
Critical · v3.1 (wordfence)
EPSS score
75.56%
0%100%
Critical · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits5reference, exploit-database, metasploit

Timeline

  1. 30-06-2015
    PublishedVulnerability first disclosed.
  2. 06-08-2024
    Last modifiedVulnerability information updated.

Description

The ThemePunch Slider Revolution (revslider) plugin before 3.0.96 for WordPress and Showbiz Pro plugin 1.7.1 and earlier for Wordpress does not properly restrict access to administrator AJAX functionality, which allows remote attackers to (1) upload and execute arbitrary files via an update_plugin action; (2) delete arbitrary sliders via a delete_slider action; and (3) create, (4) update, (5) import, or (6) export arbitrary sliders via unspecified vectors.

CVSS metrics

2 scores · 2 sources · 2 versions

EPSS trend

Probability

75.56%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

No change 0.00 pp

From 75.56% on 11-10-2026

11-10-202610-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

5 found
  • referenceUnverified

    Exploit Reference (blog.sucuri.net)

    Maturity: unknown

  • referenceUnverified

    Exploit Reference (seclists.org)

    Maturity: unknown

  • referenceUnverified

    Exploit Reference (whatisgon.wordpress.com)

    Maturity: unknown

Show all 5 exploits
  • exploit-databaseremotephpVerified

    WordPress Plugin RevSlider 3.0.95 - Arbitrary File Upload / Execution (Metasploit)

    Maturity: weaponized

  • MetasploitMetasploitremoteVerified

    WordPress RevSlider File Upload and Execute Vulnerability

    exploit/unix/webapp/wp_revslider_upload_execute

    Maturity: weaponized

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Themepunch2 products
Wordpress2 products
  • revslider< 3.0.96
  • showbizpro< 1.7.1

2 vendors · 4 products

References

8 links