CVE-2014-8603: cloner.functions.php in the XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla!

Security readout for executives and security teams

XCloner versions cited for WordPress and Joomla allowed an authenticated remote administrator to turn backup-related inputs into operating-system code execution. This is most urgent where the old plugin remains installed on internet-facing CMS sites or where CMS administrator accounts may be shared, weakly controlled, or compromised. Exposure is likely limited to sites running the cited XCloner versions with access to administrator functionality. The bundle does not identify CPEs, broader version ranges, hosting platforms, or whether later releases are affected. Prioritize remediation for internet-facing CMS environments still using the cited plugin versions. The issue can turn CMS administrator access into server-level code execution, but the provided sources do not show active exploitation. Mitigation focus: Inventory WordPress and Joomla sites for the cited XCloner versions.; Check XCloner vendor or project guidance for a fixed release or supported migration path.; Remove or disable the plugin if unused or unsupported..

Prepared

Jun 13, 2026, 22:39 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.