{"api_version":"1","generated_at":"2026-07-23T07:32:06+00:00","cve":"CVE-2014-8948","urls":{"html":"https://cve.report/CVE-2014-8948","api":"https://cve.report/api/cve/CVE-2014-8948.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2014-8948","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2014-8948"},"summary":{"title":"CVE-2014-8948","description":"Cross-site request forgery (CSRF) vulnerability in the iMember360 plugin 3.8.012 through 3.9.001 for WordPress allows remote attackers to hijack the authentication of administrators for requests that with an unspecified impact via the i4w_trace parameter.  NOTE: this can be leveraged with CVE-2014-8948 to execute arbitrary commands.","state":"PUBLISHED","assigner":"mitre","published_at":"2014-11-16 11:59:04","updated_at":"2026-05-06 22:30:45"},"problem_types":["CWE-352","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"6.8","severity":"","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:P","baseScore":6.8,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"http://seclists.org/fulldisclosure/2014/Apr/265","name":"http://seclists.org/fulldisclosure/2014/Apr/265","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"Full Disclosure: Multiple Vulnerabilities in iMember360 (Wordpress plugin)","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://packetstormsecurity.com/files/126324/WordPress-iMember360is-3.9.001-XSS-Disclosure-Code-Execution.html","name":"http://packetstormsecurity.com/files/126324/WordPress-iMember360is-3.9.001-XSS-Disclosure-Code-Execution.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"WordPress iMember360is 3.9.001 XSS / Disclosure / Code Execution ≈ Packet Storm","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.exploit-db.com/exploits/33076","name":"http://www.exploit-db.com/exploits/33076","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"Wordpress iMember360 Plugin 3.8.012 - 3.9.001 - Multiple Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/58094","name":"http://secunia.com/advisories/58094","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Security Advisory SA58094 - WordPress iMember360 Plugin Cross-Site Scripting and Cross-Site Request Forgery Vulnerabilities - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://osvdb.org/show/osvdb/106301","name":"http://osvdb.org/show/osvdb/106301","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-8948","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-8948","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2014","cve_id":"8948","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"imember360","cpe5":"imember360","cpe6":"3.8.012","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"wordpress","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"8948","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"imember360","cpe5":"imember360","cpe6":"3.8.013","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"wordpress","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"8948","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"imember360","cpe5":"imember360","cpe6":"3.8.014","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"wordpress","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"8948","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"imember360","cpe5":"imember360","cpe6":"3.9.000","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"wordpress","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"8948","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"imember360","cpe5":"imember360","cpe6":"3.9.001","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"wordpress","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T13:33:12.626Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"58094","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/58094"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://packetstormsecurity.com/files/126324/WordPress-iMember360is-3.9.001-XSS-Disclosure-Code-Execution.html"},{"name":"33076","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"],"url":"http://www.exploit-db.com/exploits/33076"},{"name":"106301","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://osvdb.org/show/osvdb/106301"},{"name":"20140424 Multiple Vulnerabilities in iMember360 (Wordpress plugin)","tags":["mailing-list","x_refsource_FULLDISC","x_transferred"],"url":"http://seclists.org/fulldisclosure/2014/Apr/265"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2014-04-24T00:00:00.000Z","descriptions":[{"lang":"en","value":"Cross-site request forgery (CSRF) vulnerability in the iMember360 plugin 3.8.012 through 3.9.001 for WordPress allows remote attackers to hijack the authentication of administrators for requests that with an unspecified impact via the i4w_trace parameter.  NOTE: this can be leveraged with CVE-2014-8948 to execute arbitrary commands."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2014-11-16T02:57:00.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"58094","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/58094"},{"tags":["x_refsource_MISC"],"url":"http://packetstormsecurity.com/files/126324/WordPress-iMember360is-3.9.001-XSS-Disclosure-Code-Execution.html"},{"name":"33076","tags":["exploit","x_refsource_EXPLOIT-DB"],"url":"http://www.exploit-db.com/exploits/33076"},{"name":"106301","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://osvdb.org/show/osvdb/106301"},{"name":"20140424 Multiple Vulnerabilities in iMember360 (Wordpress plugin)","tags":["mailing-list","x_refsource_FULLDISC"],"url":"http://seclists.org/fulldisclosure/2014/Apr/265"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2014-8948","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Cross-site request forgery (CSRF) vulnerability in the iMember360 plugin 3.8.012 through 3.9.001 for WordPress allows remote attackers to hijack the authentication of administrators for requests that with an unspecified impact via the i4w_trace parameter.  NOTE: this can be leveraged with CVE-2014-8948 to execute arbitrary commands."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"58094","refsource":"SECUNIA","url":"http://secunia.com/advisories/58094"},{"name":"http://packetstormsecurity.com/files/126324/WordPress-iMember360is-3.9.001-XSS-Disclosure-Code-Execution.html","refsource":"MISC","url":"http://packetstormsecurity.com/files/126324/WordPress-iMember360is-3.9.001-XSS-Disclosure-Code-Execution.html"},{"name":"33076","refsource":"EXPLOIT-DB","url":"http://www.exploit-db.com/exploits/33076"},{"name":"106301","refsource":"OSVDB","url":"http://osvdb.org/show/osvdb/106301"},{"name":"20140424 Multiple Vulnerabilities in iMember360 (Wordpress plugin)","refsource":"FULLDISC","url":"http://seclists.org/fulldisclosure/2014/Apr/265"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2014-8948","datePublished":"2014-11-16T11:00:00.000Z","dateReserved":"2014-11-15T00:00:00.000Z","dateUpdated":"2024-08-06T13:33:12.626Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2014-11-16 11:59:04","lastModifiedDate":"2026-05-06 22:30:45","problem_types":["CWE-352","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:P","baseScore":6.8,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:imember360:imember360:3.8.012:*:*:*:*:wordpress:*:*","matchCriteriaId":"8350DF7B-F197-4A88-A71B-0266FB93C5AE"},{"vulnerable":true,"criteria":"cpe:2.3:a:imember360:imember360:3.8.013:*:*:*:*:wordpress:*:*","matchCriteriaId":"C8D08029-AA96-404B-BA06-935502F55D4B"},{"vulnerable":true,"criteria":"cpe:2.3:a:imember360:imember360:3.8.014:*:*:*:*:wordpress:*:*","matchCriteriaId":"71D63ADE-4550-4908-B7E5-6EA8FD837BA6"},{"vulnerable":true,"criteria":"cpe:2.3:a:imember360:imember360:3.9.000:*:*:*:*:wordpress:*:*","matchCriteriaId":"2770E68B-B66C-44AD-802F-A89F83E8C33C"},{"vulnerable":true,"criteria":"cpe:2.3:a:imember360:imember360:3.9.001:*:*:*:*:wordpress:*:*","matchCriteriaId":"836D2850-2D63-4AE3-AE20-49B4DA9BA80D"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2014","CveId":"8948","Ordinal":"1","Title":"CVE-2014-8948","CVE":"CVE-2014-8948","Year":"2014"},"notes":[{"CveYear":"2014","CveId":"8948","Ordinal":"1","NoteData":"Cross-site request forgery (CSRF) vulnerability in the iMember360 plugin 3.8.012 through 3.9.001 for WordPress allows remote attackers to hijack the authentication of administrators for requests that with an unspecified impact via the i4w_trace parameter.  NOTE: this can be leveraged with CVE-2014-8948 to execute arbitrary commands.","Type":"Description","Title":"CVE-2014-8948"},{"CveYear":"2014","CveId":"8948","Ordinal":"2","NoteData":"2014-11-16","Type":"Other","Title":"Published"},{"CveYear":"2014","CveId":"8948","Ordinal":"3","NoteData":"2014-11-15","Type":"Other","Title":"Modified"}]}}}