CVE-2019-8942
High
Description
WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an _wp_attached_file Post Meta entry can be changed to an arbitrary string, such as one ending with a .jpg?file.php substring. An attacker with author privileges can execute arbitrary code by uploading a crafted image containing PHP code in the Exif metadata. Exploitation can leverage CVE-2019-8943.
SeverityHigh
CVSS8.8
Exploit probability100. percentile82.7%
Product
Wordpress
PublishedFeb 20, 2019
First seenFeb 20, 2019
Weakness typeCWE-434Unrestricted upload of dangerous file type
How to fix
Update
- wordpress wordpress4.9.9 or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| wordpress wordpress | v < 4.9.9, 5.0 | 4.9.9 |
| debian debian_linux | 9.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.