CVE-2014-6446
The Infusionsoft Gravity Forms plugin 1.5.3 through 1.5.10 for WordPress does not properly...
The Infusionsoft Gravity Forms plugin 1.5.3 through 1.5.10 for WordPress does not properly restrict access, which allows remote attackers to upload arbitrary files and execute arbitrary PHP code via a request to utilities/code_generator.php.
Exploit likelihood
What each source reports
NVD Score used
The Infusionsoft Gravity Forms plugin 1.5.3 through 1.5.10 for WordPress does not properly restrict access, which allows remote attackers to upload arbitrary files and execute arbitrary PHP code via a request to utilities/code_generator.php.
- Record
CVE-2014-6446- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-94
- Updated
- 2026-11-02
CVE List No score
The Infusionsoft Gravity Forms plugin 1.5.3 through 1.5.10 for WordPress does not properly restrict access, which allows remote attackers to upload arbitrary files and execute arbitrary PHP code via a request to utilities/code_generator.php.
- Record
CVE-2014-6446- Updated
- 2026-11-02
EUVDEUVD-2014-6325 No score
The Infusionsoft Gravity Forms plugin 1.5.3 through 1.5.10 for WordPress does not properly restrict access, which allows remote attackers to upload arbitrary files and execute arbitrary PHP code via a request to utilities/code_generator.php.
- Record
EUVD-2014-6325- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8hj9-f7cp-vcw7 No score
The Infusionsoft Gravity Forms plugin 1.5.3 through 1.5.10 for WordPress does not properly...
The Infusionsoft Gravity Forms plugin 1.5.3 through 1.5.10 for WordPress does not properly restrict access, which allows remote attackers to upload arbitrary files and execute arbitrary PHP code via a request to utilities/code_generator.php.
- Record
GHSA-8hj9-f7cp-vcw7- Weakness
- CWE-94
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | WordPress Plugin InfusionSoft - Arbitrary File Upload (Metasploit) | 2014-10-09 |
| Metasploit | Wordpress InfusionSoft Upload Vulnerability | 2014-09-25 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-6446 is a high vulnerability (CVSS 7.5) in Infusionsoft Gravity Forms Project Gravity Forms, published September 26, 2014. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 46.2%, the 98th percentile. No source names a fixed version.