CVE-2014-8799

CVE-2014-8799 is a directory traversal vulnerability in the DukaPress plugin for WordPress, specifically affecting versions prior to 2.5.4. This flaw allows remote attackers to read arbitrary files on the server by manipulating the 'src' parameter in requests to lib/dp_image.php. With a CVSS score of 5.0 and an EPSS score indicating high exploitability, this vulnerability is considered moderately severe, requiring no authentication and having low attack complexity. The potential impact is limited to information disclosure, allowing attackers to read sensitive files but not modify them or execute code. Despite its age, exploit intelligence shows readily available exploit code, including a Metasploit module and Nuclei templates, confirming its ease of exploitation. While there is no evidence of active exploitation in the wild or inclusion in CISA's KEV catalog, the existence of public exploits and its high FAUCET Risk Score of 99/100 highlight its continued risk. Community discussion and media coverage for this CVE are minimal.