CVE-2014-5460: WordPress Slideshow Gallery plugin unrestricted PHP file upload

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityAuthenticated remote code execution with public exploit code and very high EPSS, though it requires a valid account and the plugin is old.

What it is

The Tribulant Slideshow Gallery plugin before 1.4.7 for WordPress fails to restrict uploaded file types, letting an authenticated user upload a PHP file into wp-content/uploads/slideshow-gallery/. Because that directory is web-accessible, the uploaded file can be requested directly and executed as code.

Impact

An attacker with a low-privileged authenticated account gains remote code execution on the WordPress host, allowing full compromise of the site and potentially the underlying server.

Attack surface

Reached over the network through the plugin's upload functionality; the CVSS vector (AV:N/AC:L/Au:S) indicates a single authenticated account is required and no user interaction beyond the upload is needed.

Exploitation

Public exploit code exists (multiple Exploit-tagged references and Exploit-DB entries), and EPSS is high at roughly 0.71 (99th percentile), though the CVE is not listed in CISA KEV.

What to do

• Update the Slideshow Gallery plugin to 1.4.7 or later, per the vendor changelog.
• If patching is not immediately possible, disable or remove the plugin.
• Restrict upload permissions to trusted roles only and audit accounts with upload capability.
• Block PHP execution in wp-content/uploads via web server configuration.
• Remove any unexpected PHP files already present under wp-content/uploads/slideshow-gallery/.

Detection

• Monitor wp-content/uploads/slideshow-gallery/ for newly created .php files.
• Alert on HTTP requests to PHP files under wp-content/uploads/.
• Review web server logs for POST requests to the plugin's upload endpoints followed by direct GETs to uploaded files.
• Audit WordPress users and roles for unexpected or recently added accounts with upload rights.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.