{"api_version":"1","generated_at":"2026-07-23T06:42:43+00:00","cve":"CVE-2014-2558","urls":{"html":"https://cve.report/CVE-2014-2558","api":"https://cve.report/api/cve/CVE-2014-2558.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2014-2558","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2014-2558"},"summary":{"title":"CVE-2014-2558","description":"The File Gallery plugin before 1.7.9.2 for WordPress does not properly escape strings, which allows remote administrators to execute arbitrary PHP code via a \\' (backslash quote) in the setting fields to /wp-admin/options-media.php, related to the create_function function.","state":"PUBLISHED","assigner":"mitre","published_at":"2014-05-06 14:55:05","updated_at":"2026-05-06 22:30:45"},"problem_types":["CWE-94","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"6.5","severity":"","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"http://seclists.org/fulldisclosure/2014/Apr/305","name":"http://seclists.org/fulldisclosure/2014/Apr/305","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"Full Disclosure: Arbitrary code execution by admins in File Gallery 1.7.7\t(WordPress plugin)","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/67120","name":"http://www.securityfocus.com/bid/67120","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"WordPress File Gallery Plugin 'create_function()' function Arbitrary Code Execution Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://wordpress.org/plugins/file-gallery/changelog/","name":"http://wordpress.org/plugins/file-gallery/changelog/","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"WordPress › File Gallery « WordPress Plugins","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/67183","name":"http://www.securityfocus.com/bid/67183","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"WordPress File Gallery Plugin Remote PHP Code Execution Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-2558","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-2558","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2014","cve_id":"2558","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"skyphe","cpe5":"file-gallery","cpe6":"1.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"wordpress","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"2558","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"skyphe","cpe5":"file-gallery","cpe6":"1.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"wordpress","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"2558","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"skyphe","cpe5":"file-gallery","cpe6":"1.3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"wordpress","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"2558","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"skyphe","cpe5":"file-gallery","cpe6":"1.4","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"wordpress","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"2558","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"skyphe","cpe5":"file-gallery","cpe6":"1.5","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"wordpress","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"2558","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"skyphe","cpe5":"file-gallery","cpe6":"1.5","cpe7":"a","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"wordpress","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"2558","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"skyphe","cpe5":"file-gallery","cpe6":"1.5","cpe7":"b","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"wordpress","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"2558","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"skyphe","cpe5":"file-gallery","cpe6":"1.5","cpe7":"b2","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"wordpress","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"2558","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"skyphe","cpe5":"file-gallery","cpe6":"1.5","cpe7":"b3","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"wordpress","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"2558","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"skyphe","cpe5":"file-gallery","cpe6":"1.5","cpe7":"rc1","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"wordpress","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"2558","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"skyphe","cpe5":"file-gallery","cpe6":"1.5.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"wordpress","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"2558","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"skyphe","cpe5":"file-gallery","cpe6":"1.5.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"wordpress","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"2558","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"skyphe","cpe5":"file-gallery","cpe6":"1.5.3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"wordpress","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"2558","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"skyphe","cpe5":"file-gallery","cpe6":"1.5.4","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"wordpress","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"2558","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"skyphe","cpe5":"file-gallery","cpe6":"1.5.5","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"wordpress","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"2558","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"skyphe","cpe5":"file-gallery","cpe6":"1.5.6","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"wordpress","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"2558","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"skyphe","cpe5":"file-gallery","cpe6":"1.5.7","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"wordpress","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"2558","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"skyphe","cpe5":"file-gallery","cpe6":"1.5.8","cpe7":"-","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"wordpress","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"2558","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"skyphe","cpe5":"file-gallery","cpe6":"1.5.8","cpe7":"b1","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"wordpress","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"2558","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"skyphe","cpe5":"file-gallery","cpe6":"1.5.8","cpe7":"b2","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"wordpress","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"2558","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"skyphe","cpe5":"file-gallery","cpe6":"1.5.9","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"wordpress","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"2558","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"skyphe","cpe5":"file-gallery","cpe6":"1.6","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"wordpress","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"2558","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"skyphe","cpe5":"file-gallery","cpe6":"1.6.0.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"wordpress","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"2558","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"skyphe","cpe5":"file-gallery","cpe6":"1.6.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"wordpress","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"2558","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"skyphe","cpe5":"file-gallery","cpe6":"1.6.3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"wordpress","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"2558","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"skyphe","cpe5":"file-gallery","cpe6":"1.6.4","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"wordpress","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"2558","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"skyphe","cpe5":"file-gallery","cpe6":"1.6.4.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"wordpress","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"2558","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"skyphe","cpe5":"file-gallery","cpe6":"1.6.5","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"wordpress","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"2558","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"skyphe","cpe5":"file-gallery","cpe6":"1.6.5.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"wordpress","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"2558","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"skyphe","cpe5":"file-gallery","cpe6":"1.6.5.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"wordpress","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"2558","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"skyphe","cpe5":"file-gallery","cpe6":"1.6.5.3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"wordpress","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"2558","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"skyphe","cpe5":"file-gallery","cpe6":"1.6.5.4","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"wordpress","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"2558","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"skyphe","cpe5":"file-gallery","cpe6":"1.6.5.5","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"wordpress","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"2558","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"skyphe","cpe5":"file-gallery","cpe6":"1.6.5.6","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"wordpress","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"2558","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"skyphe","cpe5":"file-gallery","cpe6":"1.6.6","cpe7":"beta","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"wordpress","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"2558","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"skyphe","cpe5":"file-gallery","cpe6":"1.7","cpe7":"-","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"wordpress","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"2558","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"skyphe","cpe5":"file-gallery","cpe6":"1.7","cpe7":"rc10","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"wordpress","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"2558","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"skyphe","cpe5":"file-gallery","cpe6":"1.7","cpe7":"rc11","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"wordpress","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"2558","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"skyphe","cpe5":"file-gallery","cpe6":"1.7","cpe7":"rc12","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"wordpress","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"2558","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"skyphe","cpe5":"file-gallery","cpe6":"1.7","cpe7":"rc13","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"wordpress","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"2558","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"skyphe","cpe5":"file-gallery","cpe6":"1.7","cpe7":"rc14","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"wordpress","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"2558","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"skyphe","cpe5":"file-gallery","cpe6":"1.7","cpe7":"rc3","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"wordpress","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"2558","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"skyphe","cpe5":"file-gallery","cpe6":"1.7","cpe7":"rc4","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"wordpress","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"2558","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"skyphe","cpe5":"file-gallery","cpe6":"1.7","cpe7":"rc5","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"wordpress","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"2558","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"skyphe","cpe5":"file-gallery","cpe6":"1.7","cpe7":"rc6","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"wordpress","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"2558","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"skyphe","cpe5":"file-gallery","cpe6":"1.7","cpe7":"rc7","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"wordpress","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"2558","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"skyphe","cpe5":"file-gallery","cpe6":"1.7","cpe7":"rc8","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"wordpress","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"2558","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"skyphe","cpe5":"file-gallery","cpe6":"1.7","cpe7":"rc9","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"wordpress","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"2558","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"skyphe","cpe5":"file-gallery","cpe6":"1.7.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"wordpress","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"2558","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"skyphe","cpe5":"file-gallery","cpe6":"1.7.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"wordpress","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"2558","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"skyphe","cpe5":"file-gallery","cpe6":"1.7.3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"wordpress","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"2558","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"skyphe","cpe5":"file-gallery","cpe6":"1.7.4","cpe7":"-","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"wordpress","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"2558","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"skyphe","cpe5":"file-gallery","cpe6":"1.7.4","cpe7":"rc2","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"wordpress","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"2558","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"skyphe","cpe5":"file-gallery","cpe6":"1.7.4.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"wordpress","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"2558","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"skyphe","cpe5":"file-gallery","cpe6":"1.7.5","cpe7":"-","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"wordpress","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"2558","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"skyphe","cpe5":"file-gallery","cpe6":"1.7.5","cpe7":"beta1","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"wordpress","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"2558","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"skyphe","cpe5":"file-gallery","cpe6":"1.7.5","cpe7":"beta2","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"wordpress","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"2558","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"skyphe","cpe5":"file-gallery","cpe6":"1.7.5.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"wordpress","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"2558","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"skyphe","cpe5":"file-gallery","cpe6":"1.7.5.3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"wordpress","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"2558","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"skyphe","cpe5":"file-gallery","cpe6":"1.7.6","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"wordpress","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"2558","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"skyphe","cpe5":"file-gallery","cpe6":"1.7.7","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"wordpress","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"2558","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"skyphe","cpe5":"file-gallery","cpe6":"1.7.8","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"wordpress","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"2558","vulnerable":"1","versionEndIncluding":"1.7.9","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"skyphe","cpe5":"file-gallery","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"wordpress","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T10:21:34.678Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_MISC","x_transferred"],"url":"http://wordpress.org/plugins/file-gallery/changelog/"},{"name":"67120","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/67120"},{"name":"20140429 Arbitrary code execution by admins in File Gallery 1.7.7 (WordPress plugin)","tags":["mailing-list","x_refsource_FULLDISC","x_transferred"],"url":"http://seclists.org/fulldisclosure/2014/Apr/305"},{"name":"67183","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/67183"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2014-04-29T00:00:00.000Z","descriptions":[{"lang":"en","value":"The File Gallery plugin before 1.7.9.2 for WordPress does not properly escape strings, which allows remote administrators to execute arbitrary PHP code via a \\' (backslash quote) in the setting fields to /wp-admin/options-media.php, related to the create_function function."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2014-05-06T12:57:00.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"tags":["x_refsource_MISC"],"url":"http://wordpress.org/plugins/file-gallery/changelog/"},{"name":"67120","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/67120"},{"name":"20140429 Arbitrary code execution by admins in File Gallery 1.7.7 (WordPress plugin)","tags":["mailing-list","x_refsource_FULLDISC"],"url":"http://seclists.org/fulldisclosure/2014/Apr/305"},{"name":"67183","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/67183"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2014-2558","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The File Gallery plugin before 1.7.9.2 for WordPress does not properly escape strings, which allows remote administrators to execute arbitrary PHP code via a \\' (backslash quote) in the setting fields to /wp-admin/options-media.php, related to the create_function function."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"http://wordpress.org/plugins/file-gallery/changelog/","refsource":"MISC","url":"http://wordpress.org/plugins/file-gallery/changelog/"},{"name":"67120","refsource":"BID","url":"http://www.securityfocus.com/bid/67120"},{"name":"20140429 Arbitrary code execution by admins in File Gallery 1.7.7 (WordPress plugin)","refsource":"FULLDISC","url":"http://seclists.org/fulldisclosure/2014/Apr/305"},{"name":"67183","refsource":"BID","url":"http://www.securityfocus.com/bid/67183"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2014-2558","datePublished":"2014-05-06T14:00:00.000Z","dateReserved":"2014-03-19T00:00:00.000Z","dateUpdated":"2024-08-06T10:21:34.678Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2014-05-06 14:55:05","lastModifiedDate":"2026-05-06 22:30:45","problem_types":["CWE-94","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:skyphe:file-gallery:*:*:*:*:*:wordpress:*:*","versionEndIncluding":"1.7.9","matchCriteriaId":"B68E2A63-623A-436B-B262-C5B850D9CEC7"},{"vulnerable":true,"criteria":"cpe:2.3:a:skyphe:file-gallery:1.1:*:*:*:*:wordpress:*:*","matchCriteriaId":"AF58CB15-536B-4485-B5BC-DAC12698C711"},{"vulnerable":true,"criteria":"cpe:2.3:a:skyphe:file-gallery:1.2:*:*:*:*:wordpress:*:*","matchCriteriaId":"2AD0033F-7EB7-4A5B-9560-7B672963B885"},{"vulnerable":true,"criteria":"cpe:2.3:a:skyphe:file-gallery:1.3:*:*:*:*:wordpress:*:*","matchCriteriaId":"9CE8AA8B-769D-4339-B51E-DC4F91C56A94"},{"vulnerable":true,"criteria":"cpe:2.3:a:skyphe:file-gallery:1.4:*:*:*:*:wordpress:*:*","matchCriteriaId":"DA149601-A2ED-4BB8-8DAC-7234679B2AAD"},{"vulnerable":true,"criteria":"cpe:2.3:a:skyphe:file-gallery:1.5:*:*:*:*:wordpress:*:*","matchCriteriaId":"E3E4DA99-306F-4A60-8449-87EABDAB5F12"},{"vulnerable":true,"criteria":"cpe:2.3:a:skyphe:file-gallery:1.5:a:*:*:*:wordpress:*:*","matchCriteriaId":"6F1C54AA-0377-49CF-B4D6-655A2EF3E648"},{"vulnerable":true,"criteria":"cpe:2.3:a:skyphe:file-gallery:1.5:b:*:*:*:wordpress:*:*","matchCriteriaId":"D9475240-7B0D-406D-8D2E-DE23C76ABB84"},{"vulnerable":true,"criteria":"cpe:2.3:a:skyphe:file-gallery:1.5:b2:*:*:*:wordpress:*:*","matchCriteriaId":"82132E15-FB4D-4F52-93AA-47318206DAC0"},{"vulnerable":true,"criteria":"cpe:2.3:a:skyphe:file-gallery:1.5:b3:*:*:*:wordpress:*:*","matchCriteriaId":"8A171A71-4AC6-4717-B54D-5AAC59039BEE"},{"vulnerable":true,"criteria":"cpe:2.3:a:skyphe:file-gallery:1.5:rc1:*:*:*:wordpress:*:*","matchCriteriaId":"9242D53C-5258-4204-9022-0D8DB1EA3934"},{"vulnerable":true,"criteria":"cpe:2.3:a:skyphe:file-gallery:1.5.1:*:*:*:*:wordpress:*:*","matchCriteriaId":"4089F04C-255E-4D1A-B6F5-6757B9282826"},{"vulnerable":true,"criteria":"cpe:2.3:a:skyphe:file-gallery:1.5.2:*:*:*:*:wordpress:*:*","matchCriteriaId":"34E28E0C-BC99-41FF-B8F8-E64929BB3598"},{"vulnerable":true,"criteria":"cpe:2.3:a:skyphe:file-gallery:1.5.3:*:*:*:*:wordpress:*:*","matchCriteriaId":"26B95CB6-153C-4616-9811-B17F40D6357C"},{"vulnerable":true,"criteria":"cpe:2.3:a:skyphe:file-gallery:1.5.4:*:*:*:*:wordpress:*:*","matchCriteriaId":"EC401079-6980-43CD-BF8F-DDE2161B1EA4"},{"vulnerable":true,"criteria":"cpe:2.3:a:skyphe:file-gallery:1.5.5:*:*:*:*:wordpress:*:*","matchCriteriaId":"6F7B65A9-56F0-4B72-A9F6-7AA490637C3D"},{"vulnerable":true,"criteria":"cpe:2.3:a:skyphe:file-gallery:1.5.6:*:*:*:*:wordpress:*:*","matchCriteriaId":"C2E213C9-E831-44B3-8599-BCE6E64F8C97"},{"vulnerable":true,"criteria":"cpe:2.3:a:skyphe:file-gallery:1.5.7:*:*:*:*:wordpress:*:*","matchCriteriaId":"859DE07F-6947-4C3F-9004-9F4A2DB40BC3"},{"vulnerable":true,"criteria":"cpe:2.3:a:skyphe:file-gallery:1.5.8:-:*:*:*:wordpress:*:*","matchCriteriaId":"12B72E15-9D11-4CA6-92CA-E86B423242FD"},{"vulnerable":true,"criteria":"cpe:2.3:a:skyphe:file-gallery:1.5.8:b1:*:*:*:wordpress:*:*","matchCriteriaId":"9512BEB9-26A1-4428-8ACE-F10FE57CE9E3"},{"vulnerable":true,"criteria":"cpe:2.3:a:skyphe:file-gallery:1.5.8:b2:*:*:*:wordpress:*:*","matchCriteriaId":"992A1059-E3D2-41DE-8B2D-3B99C5132D69"},{"vulnerable":true,"criteria":"cpe:2.3:a:skyphe:file-gallery:1.5.9:*:*:*:*:wordpress:*:*","matchCriteriaId":"4A1A5B3D-3868-41F4-8D0F-A36EFA425121"},{"vulnerable":true,"criteria":"cpe:2.3:a:skyphe:file-gallery:1.6:*:*:*:*:wordpress:*:*","matchCriteriaId":"6E51AC25-7047-4DFB-B949-49F39D1B3C15"},{"vulnerable":true,"criteria":"cpe:2.3:a:skyphe:file-gallery:1.6.0.1:*:*:*:*:wordpress:*:*","matchCriteriaId":"77B4A67F-5144-4E3F-AB6B-D36760AAFEA7"},{"vulnerable":true,"criteria":"cpe:2.3:a:skyphe:file-gallery:1.6.2:*:*:*:*:wordpress:*:*","matchCriteriaId":"98B23279-BD2D-40CF-BFD8-8D945AE9934C"},{"vulnerable":true,"criteria":"cpe:2.3:a:skyphe:file-gallery:1.6.3:*:*:*:*:wordpress:*:*","matchCriteriaId":"FAF2D9B3-7DB9-4EF5-8018-6FE26EA2864F"},{"vulnerable":true,"criteria":"cpe:2.3:a:skyphe:file-gallery:1.6.4:*:*:*:*:wordpress:*:*","matchCriteriaId":"AC320AA7-33B4-40D1-97B0-99D065535E58"},{"vulnerable":true,"criteria":"cpe:2.3:a:skyphe:file-gallery:1.6.4.1:*:*:*:*:wordpress:*:*","matchCriteriaId":"9364A096-2B2D-4403-8850-75525B583635"},{"vulnerable":true,"criteria":"cpe:2.3:a:skyphe:file-gallery:1.6.5:*:*:*:*:wordpress:*:*","matchCriteriaId":"6A93DC23-4D82-4C5E-AF98-15F60C31E7DB"},{"vulnerable":true,"criteria":"cpe:2.3:a:skyphe:file-gallery:1.6.5.1:*:*:*:*:wordpress:*:*","matchCriteriaId":"EBFF70FD-9D98-4E0E-BEF3-AF06ADFBF025"},{"vulnerable":true,"criteria":"cpe:2.3:a:skyphe:file-gallery:1.6.5.2:*:*:*:*:wordpress:*:*","matchCriteriaId":"486E575D-FFA7-45EF-A31A-A5FC26E68AC8"},{"vulnerable":true,"criteria":"cpe:2.3:a:skyphe:file-gallery:1.6.5.3:*:*:*:*:wordpress:*:*","matchCriteriaId":"6E025600-7048-4254-B626-D9F649D39C12"},{"vulnerable":true,"criteria":"cpe:2.3:a:skyphe:file-gallery:1.6.5.4:*:*:*:*:wordpress:*:*","matchCriteriaId":"ABD67520-9D03-4AAE-8EAA-2CC3540CAEA4"},{"vulnerable":true,"criteria":"cpe:2.3:a:skyphe:file-gallery:1.6.5.5:*:*:*:*:wordpress:*:*","matchCriteriaId":"070163E5-6582-4475-BAFF-E2531E2D89CB"},{"vulnerable":true,"criteria":"cpe:2.3:a:skyphe:file-gallery:1.6.5.6:*:*:*:*:wordpress:*:*","matchCriteriaId":"D8531A96-1428-45BD-91BA-BB4D04850E7C"},{"vulnerable":true,"criteria":"cpe:2.3:a:skyphe:file-gallery:1.6.6:beta:*:*:*:wordpress:*:*","matchCriteriaId":"4261DF6C-D6E7-4F3D-A66D-9221FE02B633"},{"vulnerable":true,"criteria":"cpe:2.3:a:skyphe:file-gallery:1.7:-:*:*:*:wordpress:*:*","matchCriteriaId":"99C448D8-ACDB-44A0-8C17-C1AC416A9FC9"},{"vulnerable":true,"criteria":"cpe:2.3:a:skyphe:file-gallery:1.7:rc10:*:*:*:wordpress:*:*","matchCriteriaId":"ADB81F63-ED94-47B3-B285-10F4CDF3B45E"},{"vulnerable":true,"criteria":"cpe:2.3:a:skyphe:file-gallery:1.7:rc11:*:*:*:wordpress:*:*","matchCriteriaId":"40F1C6BD-8268-4AEC-8FAC-24162BF981D4"},{"vulnerable":true,"criteria":"cpe:2.3:a:skyphe:file-gallery:1.7:rc12:*:*:*:wordpress:*:*","matchCriteriaId":"7DD90BB2-4242-483D-9818-5AF8684319A0"},{"vulnerable":true,"criteria":"cpe:2.3:a:skyphe:file-gallery:1.7:rc13:*:*:*:wordpress:*:*","matchCriteriaId":"308FD8F6-A30C-4024-9667-5FA560DBFB83"},{"vulnerable":true,"criteria":"cpe:2.3:a:skyphe:file-gallery:1.7:rc14:*:*:*:wordpress:*:*","matchCriteriaId":"31542CAA-5B4E-4E1B-AB25-60C5CC299DA6"},{"vulnerable":true,"criteria":"cpe:2.3:a:skyphe:file-gallery:1.7:rc3:*:*:*:wordpress:*:*","matchCriteriaId":"7DE9DEDA-18F1-4FE9-85D4-30D67AD7BB77"},{"vulnerable":true,"criteria":"cpe:2.3:a:skyphe:file-gallery:1.7:rc4:*:*:*:wordpress:*:*","matchCriteriaId":"DAA8CCB7-6A41-4D24-8748-BE3E6E1121DA"},{"vulnerable":true,"criteria":"cpe:2.3:a:skyphe:file-gallery:1.7:rc5:*:*:*:wordpress:*:*","matchCriteriaId":"02B08C9C-B340-49B1-A69C-A8A3F85E2211"},{"vulnerable":true,"criteria":"cpe:2.3:a:skyphe:file-gallery:1.7:rc6:*:*:*:wordpress:*:*","matchCriteriaId":"FFFEC765-88C2-4151-92C8-CDCC9CFE2908"},{"vulnerable":true,"criteria":"cpe:2.3:a:skyphe:file-gallery:1.7:rc7:*:*:*:wordpress:*:*","matchCriteriaId":"42EB8144-F2C2-449B-AE94-4155ADCB0C32"},{"vulnerable":true,"criteria":"cpe:2.3:a:skyphe:file-gallery:1.7:rc8:*:*:*:wordpress:*:*","matchCriteriaId":"81B83688-BB06-46BB-ACD3-97FDA26BB2A9"},{"vulnerable":true,"criteria":"cpe:2.3:a:skyphe:file-gallery:1.7:rc9:*:*:*:wordpress:*:*","matchCriteriaId":"720BD335-4ED5-43D2-8D9B-9222BBDAEDB4"},{"vulnerable":true,"criteria":"cpe:2.3:a:skyphe:file-gallery:1.7.1:*:*:*:*:wordpress:*:*","matchCriteriaId":"93454615-3C45-40D1-9C8B-5823D7099F30"},{"vulnerable":true,"criteria":"cpe:2.3:a:skyphe:file-gallery:1.7.2:*:*:*:*:wordpress:*:*","matchCriteriaId":"AA440FDF-2375-4F4E-9005-0606A66804DB"},{"vulnerable":true,"criteria":"cpe:2.3:a:skyphe:file-gallery:1.7.3:*:*:*:*:wordpress:*:*","matchCriteriaId":"01700FA8-928B-4346-B6D0-6D560B7EB76B"},{"vulnerable":true,"criteria":"cpe:2.3:a:skyphe:file-gallery:1.7.4:-:*:*:*:wordpress:*:*","matchCriteriaId":"10BFDCCC-56CD-440B-A425-F4EF8A9635E5"},{"vulnerable":true,"criteria":"cpe:2.3:a:skyphe:file-gallery:1.7.4:rc2:*:*:*:wordpress:*:*","matchCriteriaId":"911975C3-47BE-46AC-976F-7D7E5471F929"},{"vulnerable":true,"criteria":"cpe:2.3:a:skyphe:file-gallery:1.7.4.1:*:*:*:*:wordpress:*:*","matchCriteriaId":"C39EA776-E308-4E8F-B452-1A8172CBBF67"},{"vulnerable":true,"criteria":"cpe:2.3:a:skyphe:file-gallery:1.7.5:-:*:*:*:wordpress:*:*","matchCriteriaId":"697D80E3-FA33-4B71-81A3-8C8C56D1AC15"},{"vulnerable":true,"criteria":"cpe:2.3:a:skyphe:file-gallery:1.7.5:beta1:*:*:*:wordpress:*:*","matchCriteriaId":"19958EF8-99A4-4143-9929-DE0C43D6F5CC"},{"vulnerable":true,"criteria":"cpe:2.3:a:skyphe:file-gallery:1.7.5:beta2:*:*:*:wordpress:*:*","matchCriteriaId":"96F45A71-2219-4E1A-8CF6-A72E51FE2E9F"},{"vulnerable":true,"criteria":"cpe:2.3:a:skyphe:file-gallery:1.7.5.1:*:*:*:*:wordpress:*:*","matchCriteriaId":"C9C1F30A-6265-405B-AAF8-A34D5A91C1B1"},{"vulnerable":true,"criteria":"cpe:2.3:a:skyphe:file-gallery:1.7.5.3:*:*:*:*:wordpress:*:*","matchCriteriaId":"BEAAAB83-E8C0-4BA4-8BE7-1E9F132892F8"},{"vulnerable":true,"criteria":"cpe:2.3:a:skyphe:file-gallery:1.7.6:*:*:*:*:wordpress:*:*","matchCriteriaId":"DBFEC6DC-5652-4E25-A2FD-CF1539E1B88D"},{"vulnerable":true,"criteria":"cpe:2.3:a:skyphe:file-gallery:1.7.7:*:*:*:*:wordpress:*:*","matchCriteriaId":"A3AB4A72-7323-450F-97C6-9310F293AC08"},{"vulnerable":true,"criteria":"cpe:2.3:a:skyphe:file-gallery:1.7.8:*:*:*:*:wordpress:*:*","matchCriteriaId":"1B331237-29BD-40B4-A0EF-3033E1BF8219"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2014","CveId":"2558","Ordinal":"1","Title":"CVE-2014-2558","CVE":"CVE-2014-2558","Year":"2014"},"notes":[{"CveYear":"2014","CveId":"2558","Ordinal":"1","NoteData":"The File Gallery plugin before 1.7.9.2 for WordPress does not properly escape strings, which allows remote administrators to execute arbitrary PHP code via a \\' (backslash quote) in the setting fields to /wp-admin/options-media.php, related to the create_function function.","Type":"Description","Title":"CVE-2014-2558"},{"CveYear":"2014","CveId":"2558","Ordinal":"2","NoteData":"2014-05-06","Type":"Other","Title":"Published"},{"CveYear":"2014","CveId":"2558","Ordinal":"3","NoteData":"2014-05-06","Type":"Other","Title":"Modified"}]}}}