CVE-2019-9787
High
Description
WordPress before 5.1.1 does not properly filter comment content, leading to Remote Code Execution by unauthenticated users in a default configuration. This occurs because CSRF protection is mishandled, and because Search Engine Optimization of A elements is performed incorrectly, leading to XSS. The XSS results in administrative access, which allows arbitrary changes to .php files. This is related to wp-admin/includes/ajax-actions.php and wp-includes/comment.php.
SeverityHigh
CVSS8.8
Exploit probability99. percentile38.6%
Product
Wordpress
PublishedMar 14, 2019
First seenMar 14, 2019
Weakness typeCWE-352Cross-site request forgery (CSRF)
How to fix
Update
- wordpress wordpress5.1.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| wordpress wordpress | v < 5.1.1 | 5.1.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.