CVE-2014-8739: jQuery File Upload Plugin unrestricted PHP upload in WordPress and Joomla contact forms

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityUnauthenticated remote code execution with a 9.8 CVSS score, public exploits, and documented in-the-wild exploitation make this an urgent fix despite the absence of a KEV listing.

What it is

The jQuery File Upload Plugin 6.4.4, bundled in Creative Solutions Creative Contact Form before 1.0.0 for WordPress and before 2.0.1 for Joomla!, fails to restrict uploaded file types in server/php/UploadHandler.php. An attacker can upload a PHP file and then request it directly from files/, turning the upload endpoint into remote code execution. The flaw was exploited in the wild in October 2014 and carries a CVSS 3.1 score of 9.8.

Impact

An unauthenticated attacker gains arbitrary PHP code execution on the web server, which typically means full control of the application and its data. That can lead to site takeover, data theft, or use of the host as a pivot.

Attack surface

Reachable over the network through the plugin's upload handler; the CVSS vector AV:N/AC:L/PR:N/UI:N indicates no authentication and no user interaction are required. The attacker only needs to POST a PHP file and then fetch it from the files/ directory.

Exploitation

Not listed in CISA KEV, but EPSS is 0.91656 (99.8th percentile) and two Exploit-DB entries (35057, 36811) are referenced, and the description states it was exploited in the wild in October 2014. Exploitation is therefore well established and public.

What to do

• Update Creative Contact Form to 1.0.0 or later on WordPress, or 2.0.1 or later on Joomla!, and update the bundled jQuery File Upload Plugin to a fixed release.
• If patching is not immediately possible, remove or disable the vulnerable contact form plugin and its upload endpoint.
• Restrict the files/ upload directory so it cannot execute scripts (for example, disable PHP handling for that path in the web server configuration).
• Enforce server-side upload validation that rejects executable extensions and verifies file content, rather than relying on client-side checks.
• Run the web application with least privilege so a compromised process cannot write outside its intended directories.

Detection

• Monitor web server logs for POST requests to the plugin's upload handler followed by GET requests for newly created files under files/ with .php or similar executable extensions.
• Alert on creation of executable files in upload or files directories using file integrity monitoring.
• Search existing web roots for unexpected PHP files in upload directories and review them for webshell content.
• Correlate outbound or child-process activity from the web server user that follows an upload request, which may indicate code execution.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.