cbcvebase.
CVE-2014-5337
published 2014-08-29

CVE-2014-5337: The WordPress Mobile Pack plugin before 2.0.2 for WordPress does not properly restrict access to password protected posts, which allows remote attackers to…

PriorityP341medium5CVSS 2.0
AVNACLAuNCPINAN
EXPLOIT
EPSS
16.99%
96.7th percentile
The WordPress Mobile Pack plugin before 2.0.2 for WordPress does not properly restrict access to password protected posts, which allows remote attackers to obtain sensitive information via an exportarticles action to export/content.php.

Affected

14 ranges
VendorProductVersion rangeFixed in
wordpress_mobile_pack_projectwordpress_mobile_pack<= 2.0.1—
wordpress_mobile_pack_projectwordpress_mobile_pack——
wpmobilepackwordpress_mobile_pack——
wpmobilepackwordpress_mobile_pack——
wpmobilepackwordpress_mobile_pack——
wpmobilepackwordpress_mobile_pack——
wpmobilepackwordpress_mobile_pack——
wpmobilepackwordpress_mobile_pack——
wpmobilepackwordpress_mobile_pack——
wpmobilepackwordpress_mobile_pack——
wpmobilepackwordpress_mobile_pack——
wpmobilepackwordpress_mobile_pack——
wpmobilepackwordpress_mobile_pack——
wpmobilepackwordpress_mobile_pack——

Detection & IOCsextracted from sources · hover to see the quote

urlexport/content.php↗
commandexportarticles↗
  • →Monitor HTTP requests targeting the path 'export/content.php' on WordPress installations, particularly those including an 'exportarticles' action parameter, which indicates exploitation of the WP Mobile Pack information disclosure vulnerability. ↗
  • →The Metasploit auxiliary module 'scanner/http/wp_mobile_pack_info_disclosure' can be used as a reference for building detection signatures around automated exploitation attempts against this vulnerability. ↗
  • ·The NVD advisory states the vulnerability affects versions before 2.0.2, but the Metasploit module targets version 2.1.2 specifically — detection logic should cover a broad version range rather than a single pinned version. ↗
  • ·The vulnerability bypasses WordPress password-protected post restrictions, meaning exploitation does not require authentication — unauthenticated requests to the export endpoint should be treated as suspicious. ↗
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.