← Vulnerability feed

Vulnerability record · CVE-2014-8801 · published 28 November 2014

CVE-2014-8801: Strangerstudios paid memberships pro path traversal vulnerability

Strangerstudios · Paid Memberships Pro

Directory traversal vulnerability in services/getfile.php in the Paid Memberships Pro plugin before 1.7.15 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the QUERY_STRING in a getfile action to wp-admin/admin-ajax.php.

5.0 CVSS 2.0 Medium EPSS 18% · top 2.9% CWE-22 · Path traversal
5.0CVSS 2.0 base score
18%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
14References, 4 tagged exploit
17 Jun 2026Last modified by NVD

Description

Directory traversal vulnerability in services/getfile.php in the Paid Memberships Pro plugin before 1.7.15 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the QUERY_STRING in a getfile action to wp-admin/admin-ajax.php.

AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://packetstormsecurity.com/files/129189/Paid-Memberships-Pro-1.7.14.2-Path-Traversal.html ExploitThird Party AdvisoryVDB Entry
http://security.szurek.pl/paid-memberships-pro-17142-path-traversal.html Broken Link
http://www.exploit-db.com/exploits/35303 ExploitThird Party AdvisoryVDB Entry
http://www.paidmembershipspro.com/2014/11/critical-security-update-pmpro-v1-7-15/ Release NotesThird Party Advisory
http://www.securityfocus.com/bid/71293 Third Party AdvisoryVDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/98805 Third Party AdvisoryVDB Entry
https://wordpress.org/plugins/paid-memberships-pro/changelog/ Release NotesThird Party Advisory
http://packetstormsecurity.com/files/129189/Paid-Memberships-Pro-1.7.14.2-Path-Traversal.html ExploitThird Party AdvisoryVDB Entry
http://security.szurek.pl/paid-memberships-pro-17142-path-traversal.html Broken Link
http://www.exploit-db.com/exploits/35303 ExploitThird Party AdvisoryVDB Entry
http://www.paidmembershipspro.com/2014/11/critical-security-update-pmpro-v1-7-15/ Release NotesThird Party Advisory
http://www.securityfocus.com/bid/71293 Third Party AdvisoryVDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/98805 Third Party AdvisoryVDB Entry
https://wordpress.org/plugins/paid-memberships-pro/changelog/ Release NotesThird Party Advisory

Track CVE-2014-8801 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2024-37277Strangerstudios paid memberships pro insecure direct object reference vulnerabilityAuthorization Bypass Through User-Controlled Key vulnerability in Paid Memberships Pro allows Accessing Functionality Not Properly Constrained by ACL…EPSS 0.67%9.8CVE-2023-23488Paid Memberships Pro WordPress plugin unauthenticated SQL injectionThe Paid Memberships Pro WordPress plugin before version 2.9.8 is affected by an unauthenticated SQL injection in the 'code' parameter of the '/pmpro…EPSS 92%analysed9.8CVE-2021-25114Paid Memberships Pro unauthenticated SQL injection via discount_codeThe Paid Memberships Pro WordPress plugin before 2.6.7 fails to escape the discount_code parameter in a REST route that is reachable without authenti…EPSS 82%analysed8.8CVE-2023-39990Strangerstudios paid memberships pro missing authorization vulnerabilityMissing Authorization vulnerability in Paid Memberships Pro.This issue affects Paid Memberships Pro: from n/a through 1.2.3.EPSS 0.48%8.8CVE-2024-32793Strangerstudios paid memberships pro cross-site request forgery vulnerabilityCross-Site Request Forgery (CSRF) vulnerability in Paid Memberships Pro.This issue affects Paid Memberships Pro: from n/a through 2.12.10.EPSS 0.23%8.8CVE-2024-32794Strangerstudios paid memberships pro cross-site request forgery vulnerabilityCross-Site Request Forgery (CSRF) vulnerability in Paid Memberships Pro.This issue affects Paid Memberships Pro: from n/a through 2.12.10.EPSS 0.25%8.8CVE-2023-6187Paid Memberships Pro WordPress plugin arbitrary file uploadThe Paid Memberships Pro plugin for WordPress fails to properly validate file types in the pmpro_paypalexpress_session_vars_for_user_fields function …EPSS 51%analysed8.8CVE-2023-0631Paid Memberships Pro WordPress plugin SQL injection via shortcodesThe Paid Memberships Pro WordPress plugin before 2.9.12 fails to prevent subscribers from rendering shortcodes that concatenate attributes directly i…EPSS 60%analysed

Source: NIST National Vulnerability Database (record CVE-2014-8801), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.