Security restrictions bypass in WordPress - CVE-2018-20147
Published: December 13, 2018 / Updated: December 17, 2018
Vulnerability identifier: #VU16523
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-20147
CWE-ID: CWE-264
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass security restrictions on the target system.
The weakness exists due to unspecified flaw. A remote attacker can bypass security restrictions and alter meta data to delete files that he wasn't authorized to.
The weakness exists due to unspecified flaw. A remote attacker can bypass security restrictions and alter meta data to delete files that he wasn't authorized to.
Affected software
WordPress
wordpress (Debian package)
wordpress (Debian package)
How to mitigate CVE-2018-20147
Update to version 5.0.1.
WordPress - update to 5.0.1
wordpress (Debian package) - update to 4.7.5+dfsg-2+deb9u5
wordpress (Debian package) - update to 4.7.5+dfsg-2+deb9u5