CVE-2014-6242
Multiple SQL injection vulnerabilities in the All In One WP Security & Firewall plugin before 3.8...
Multiple SQL injection vulnerabilities in the All In One WP Security & Firewall plugin before 3.8.3 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) orderby or (2) order parameter in the aiowpsec page to wp-admin/admin.php. NOTE: this can be leveraged using CSRF to allow remote attackers to execute arbitrary SQL commands.
Exploit likelihood
What each source reports
NVD Score used
Multiple SQL injection vulnerabilities in the All In One WP Security & Firewall plugin before 3.8.3 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) orderby or (2) order parameter in the aiowpsec page to wp-admin/admin.php. NOTE: this can be leveraged using CSRF to allow remote attackers to execute arbitrary SQL commands.
- Record
CVE-2014-6242- CVSS 2.0
- 6.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:P - Weakness
- CWE-89
- Updated
- 2026-11-02
CVE List No score
Multiple SQL injection vulnerabilities in the All In One WP Security & Firewall plugin before 3.8.3 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) orderby or (2) order parameter in the aiowpsec page to wp-admin/admin.php. NOTE: this can be leveraged using CSRF to allow remote attackers to execute arbitrary SQL commands.
- Record
CVE-2014-6242- Updated
- 2026-11-02
EUVDEUVD-2014-6128 No score
Multiple SQL injection vulnerabilities in the All In One WP Security & Firewall plugin before 3.8.3 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) orderby or (2) order parameter in the aiowpsec page to wp-admin/admin.php. NOTE: this can be leveraged using CSRF to allow remote attackers to execute arbitrary SQL commands.
- Record
EUVD-2014-6128- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-f499-3q8w-php5 No score
Multiple SQL injection vulnerabilities in the All In One WP Security & Firewall plugin before 3.8...
Multiple SQL injection vulnerabilities in the All In One WP Security & Firewall plugin before 3.8.3 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) orderby or (2) order parameter in the aiowpsec page to wp-admin/admin.php. NOTE: this can be leveraged using CSRF to allow remote attackers to execute arbitrary SQL commands.
- Record
GHSA-f499-3q8w-php5- Weakness
- CWE-89
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | WordPress Plugin All In One WP Security 3.8.2 - SQL Injection | 2014-09-25 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-6242 is a medium vulnerability (CVSS 6.5) in Tips And Tricks Hq All In One Wordpress Security And Firewall, published October 2, 2014. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 4.15%, the 90th percentile. No source names a fixed version.
References
packetstormsecurity.com/files/128419/All-In-One-WP-Security-3.8.2-SQL-Injection.html
wordpress.org/plugins/all-in-one-wp-security-and-firewall/changelog
exploit-db.com/exploits/34781
securityfocus.com/bid/70150
htbridge.com/advisory/HTB23231
exchange.xforce.ibmcloud.com/vulnerabilities/96204
nvd.nist.gov/vuln/detail/CVE-2014-6242
github.com/advisories/GHSA-f499-3q8w-php5