Read the docs
TI-2014-07169 Aliases CVE-2014-8739GHSA-wxg6-f773-g2f7

Unrestricted file upload vulnerability in server/php/UploadHandler.php in the jQuery File…

Priority CRITICAL 85CWE-434Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-434.

Summary

Unrestricted file upload vulnerability in server/php/UploadHandler.php in the jQuery File Upload Plugin 6.4.4 for jQuery, as used in the Creative Solutions Creative Contact Form (formerly Sexy Contact Form) before 1.0.0 for WordPress and before 2.0.1 for Joomla!, allows remote attackers to execute arbitrary code by uploading a PHP file with an PHP extension, then accessing it via a direct request to the file in files/, as exploited in the wild in October 2014.

Why it matters now

EPSS 0.91858 99th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—blueimp/jquery-file-upload (Packagist)——No fix listedGHSA-wxg6-f773-g2f7
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • blueimp/jquery-file-upload (Packagist) Vendor— Affected — Fixed in — No fix listed GHSA-wxg6-f773-g2f7

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:creative-solutions:creative_contact_form:*:*:*:*:*:wordpress:*:*before 1.0.0VulnerableCreative Solutions
cpe:2.3:a:creative-solutions:creative_contact_form:*:*:*:*:*:joomla\!:*:*before 2.0.1VulnerableCreative Solutions
cpe:2.3:a:jquery_file_upload_project:jquery_file_upload:6.4.4:*:*:*:*:*:*:*6.4.4VulnerableJquery File Upload Project
  • cpe:2.3:a:creative-solutions:creative_contact_form:*:*:*:*:*:wordpress:*:* Versions before 1.0.0 Vulnerable ·Creative Solutions
  • cpe:2.3:a:creative-solutions:creative_contact_form:*:*:*:*:*:joomla\!:*:* Versions before 2.0.1 Vulnerable ·Creative Solutions
  • cpe:2.3:a:jquery_file_upload_project:jquery_file_upload:6.4.4:*:*:*:*:*:*:* Versions 6.4.4 Vulnerable ·Jquery File Upload Project

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2014-8739
  2. 2026-10-03 Alias added: GHSA-wxg6-f773-g2f7

References

Exploit 2

Advisory 5

Other 5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences