WordPress Plugin Akeeba Backup CORE for WordPress is prone to a vulnerability that lets attackers upload arbitrary files because the application fails to properly sanitize user-supplied input. An attacker can exploit this vulnerability to upload arbitrary code and run it in the context of the webserver process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible. WordPress Plugin Akeeba Backup CORE for WordPress version 1.1.3 is vulnerable; prior versions may also be affected.

Update to plugin version 1.1.5 or latest

• https://websec.wordpress.com/2014/10/05/joomla-3-3-4-akeeba-kickstart-remote-code-execution-cve-2014-7228/
• https://www.akeebabackup.com/home/news/1605-security-update-sep-2014.html