Unrated severityNVD Advisory· Published Dec 5, 2014· Updated Jun 17, 2026
CVE-2014-8877
CVE-2014-8877
Description
The alterSearchQuery function in lib/controllers/CmdownloadController.php in the CreativeMinds CM Downloads Manager plugin before 2.0.4 for WordPress allows remote attackers to execute arbitrary PHP code via the CMDsearch parameter to cmdownloads/, which is processed by the PHP create_function function.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
5- Range: <2.0.4
cpe:2.3:a:creative_minds:cm_download_manager:*:*:*:*:*:wordpress:*:*+ 3 more
- cpe:2.3:a:creative_minds:cm_download_manager:*:*:*:*:*:wordpress:*:*range: <=2.0.3
- cpe:2.3:a:creative_minds:cm_download_manager:2.0.0:*:*:*:*:wordpress:*:*
- cpe:2.3:a:creative_minds:cm_download_manager:2.0.1:*:*:*:*:wordpress:*:*
- cpe:2.3:a:creative_minds:cm_download_manager:2.0.2:*:*:*:*:wordpress:*:*
Patches
Vulnerability mechanics
References
5- packetstormsecurity.com/files/129183/WordPress-CM-Download-Manager-2.0.0-Code-Injection.htmlnvdExploit
- www.itas.vn/news/code-injection-in-cm-download-manager-plugin-66.htmlnvd
- www.securityfocus.com/archive/1/534037/100/0/threadednvd
- www.securityfocus.com/bid/71204nvd
- downloadsmanager.cminds.com/release-notes/nvd
News mentions
0No linked articles in our index yet.