VIR Vulnerability Intelligence Relay

CVE-2014-2558

medium
Published 2014-05-06 · Modified 2026-05-06
CVSS v3
—
CVSS v2
6.5
VIR risk
6.5

Description

The File Gallery plugin before 1.7.9.2 for WordPress does not properly escape strings, which allows remote administrators to execute arbitrary PHP code via a \' (backslash quote) in the setting fields to /wp-admin/options-media.php, related to the create_function function.

Predictions

Exploit likelihood
20%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: cve@mitre.org — http://wordpress.org/plugins/file-gallery/changelog/

Application impact
VendorProductVersionsFixed
skyphefile-gallery{"endIncluding":"1.7.9"}
skyphefile-gallery1.1
skyphefile-gallery1.2
skyphefile-gallery1.3
skyphefile-gallery1.4
skyphefile-gallery1.5
skyphefile-gallery1.5.1
skyphefile-gallery1.5.2
skyphefile-gallery1.5.3
skyphefile-gallery1.5.4
skyphefile-gallery1.5.5
skyphefile-gallery1.5.6
skyphefile-gallery1.5.7
skyphefile-gallery1.5.8
skyphefile-gallery1.5.9
skyphefile-gallery1.6
skyphefile-gallery1.6.0.1
skyphefile-gallery1.6.2
skyphefile-gallery1.6.3
skyphefile-gallery1.6.4
skyphefile-gallery1.6.4.1
skyphefile-gallery1.6.5
skyphefile-gallery1.6.5.1
skyphefile-gallery1.6.5.2
skyphefile-gallery1.6.5.3
skyphefile-gallery1.6.5.4
skyphefile-gallery1.6.5.5
skyphefile-gallery1.6.5.6
skyphefile-gallery1.6.6
skyphefile-gallery1.7
skyphefile-gallery1.7.1
skyphefile-gallery1.7.2
skyphefile-gallery1.7.3
skyphefile-gallery1.7.4
skyphefile-gallery1.7.4.1
skyphefile-gallery1.7.5
skyphefile-gallery1.7.5.1
skyphefile-gallery1.7.5.3
skyphefile-gallery1.7.6
skyphefile-gallery1.7.7
skyphefile-gallery1.7.8

References

CWEs

CWE-94

Verify integrity in audit chain (admin only). AS-IS.