Main
Vulnerability Database
Exploits
ID:5108 - Exploit for Path traversal in WordPress - CVE-2019-8943
ID:5108 - Exploit for Path traversal in WordPress - CVE-2019-8943
Published: February 1, 2021
Vulnerability identifier: #VU17788
Vulnerability risk: High
CVE-ID: CVE-2019-8943
CWE-ID: CWE-22
Exploitation vector: Remote access
Vulnerable software:
WordPress
WordPress
Link to public exploit:
Vulnerability description
The vulnerability allows a remote attacker to execute PHP code on the target system.
The weakness exists due to path traversal in wp_crop_image(). A remote attacker can write the output image to an arbitrary directory via a filename containing two image extensions and ../ sequences, such as a filename ending with the .jpg?/../../file.jpg substring.
Successful exploitation of the vulnerability is possible when combined with CVE-2019-8942.
The weakness exists due to path traversal in wp_crop_image(). A remote attacker can write the output image to an arbitrary directory via a filename containing two image extensions and ../ sequences, such as a filename ending with the .jpg?/../../file.jpg substring.
Successful exploitation of the vulnerability is possible when combined with CVE-2019-8942.
Remediation
Install update from vendor's website.