Vulnerability record · CVE-2014-6446 · published 26 September 2014
CVE-2014-6446: Infusionsoft Gravity Forms plugin arbitrary file upload and PHP code execution
IInfusionsoft Gravity Forms Project · Infusionsoft Gravity Forms
The Infusionsoft Gravity Forms plugin for WordPress (versions 1.5.3 through 1.5.10) fails to restrict access to utilities/code_generator.php, letting remote attackers upload arbitrary files. Because uploaded PHP can be executed, this is a direct path to remote code execution on the WordPress host.
Description
The Infusionsoft Gravity Forms plugin 1.5.3 through 1.5.10 for WordPress does not properly restrict access, which allows remote attackers to upload arbitrary files and execute arbitrary PHP code via a request to utilities/code_generator.php.
AV:N/AC:L/Au:N/C:P/I:P/A:P
Automated analysis
high priorityUnauthenticated remote code execution with public exploits and very high EPSS, though not confirmed in KEV.
What it is
The Infusionsoft Gravity Forms plugin for WordPress (versions 1.5.3 through 1.5.10) fails to restrict access to utilities/code_generator.php, letting remote attackers upload arbitrary files. Because uploaded PHP can be executed, this is a direct path to remote code execution on the WordPress host.
Impact
An unauthenticated attacker can upload and execute arbitrary PHP, gaining code execution on the web server and potentially full control of the WordPress site and its data.
Attack surface
Reached over the network via an HTTP request to the plugin's utilities/code_generator.php endpoint. The CVSS vector (AV:N/AC:L/Au:N) indicates no authentication and no user interaction are required.
Exploitation
Public exploit code exists (Exploit-DB 34925, Packet Storm, and a research writeup), and EPSS is 0.46174 (98.8th percentile), though the CVE is not listed in CISA KEV.
What to do
- Update the Infusionsoft Gravity Forms plugin to a version newer than 1.5.10 per the vendor changelog.
- If the plugin is unused, remove or deactivate it entirely.
- Restrict or block direct web access to plugin utility scripts such as utilities/code_generator.php.
- Enforce least privilege on the web server user and disable PHP execution in upload directories.
- Audit the site for unexpected or recently modified PHP files.
Detection
- Monitor web logs for requests to utilities/code_generator.php, especially POSTs with file upload content.
- Alert on new or modified PHP files in WordPress upload and plugin directories.
- Look for outbound connections or spawned processes from the web server user consistent with a web shell.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2014-6446 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2014-6446), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
