CVE-2014-8336

MEDIUM 6.5CVE-2014-8336 · Published 05/01/2018 · updated 17/06/2026

In short

CVE-2014-8336 is a MEDIUM (CVSS 6.5) vulnerability affecting wp-dbmanager (wp-dbmanager project).
Chance of exploitation in the next 30 days (EPSS): 2.6%, higher than 85.4% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
wp-dbmanager wp-dbmanager_project	`≤ 2.7.1`	No fix yet

Description

The "Sql Run Query" panel in WP-DBManager (aka Database Manager) plugin before 2.7.2 for WordPress allows remote attackers to read arbitrary files by leveraging failure to sufficiently limit queries, as demonstrated by use of LOAD_FILE in an INSERT statement.

References

openwall.com/lists/oss-security/2014/10/21/3 · Issue Tracking
vapid.dhs.org/advisories/wordpress/plugins/wp-dbmanager-2.7.1/index.html · Exploit
exchange.xforce.ibmcloud.com/vulnerabilities/97694 · Issue Tracking
lesterchan/wp-dbmanager commit 7037fa8 · Issue Tracking
wordpress.org/plugins/wp-dbmanager · Third Party Advisory

More vulnerabilities in wp-dbmanager

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

wp-dbmanager

wp-dbmanager_project

≤ 2.7.1

No fix yet

More vulnerabilities in wp-dbmanager

See all →