CVE-2019-8942

WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an wpattached_file Post Meta entry can be changed to an arbitrary string, such as one ending with a .jpg?file.php substring. An attacker with author privileges can execute arbitrary code by uploading a crafted image containing PHP code in the Exif metadata. Exploitation can leverage CVE-2019-8943.

References

Affected packages

Debian:11 / wordpress

Package

Name: wordpress
Purl: pkg:deb/debian/wordpress?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

5.0.1+dfsg1-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:12 / wordpress

Package

Name: wordpress
Purl: pkg:deb/debian/wordpress?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

5.0.1+dfsg1-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:13 / wordpress

Package

Name: wordpress
Purl: pkg:deb/debian/wordpress?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

5.0.1+dfsg1-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Git / github.com/wordpress/wordpress

Affected ranges

Type: GIT
Repo: https://github.com/wordpress/wordpress
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

8d87e4a8b8aa7d66a4f5dd3795b5450fa0b76af0

Type: GIT
Repo: https://github.com/wordpress/wordpress-develop
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

a9ad836e97a736741122210792c64a6b2ed053ba