Code injection in WordPress - CVE-2019-8942
Published: February 20, 2019 / Updated: March 1, 2019
Vulnerability identifier: #VU17803
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-8942
CWE-ID: CWE-94
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vulnerability details
The vulnerability allows a remote attacker to execute PHP code on the target system.
The weakness exists due to an _wp_attached_file Post Meta entry can be changed to an arbitrary string, such as one ending with a .jpg?file.php substring. A remote attacker can upload a crafted image containing PHP code in the Exif metadata and execute arbitrary code.
Successful exploitation of the vulnerability allows to leverage SB2019022004.
The weakness exists due to an _wp_attached_file Post Meta entry can be changed to an arbitrary string, such as one ending with a .jpg?file.php substring. A remote attacker can upload a crafted image containing PHP code in the Exif metadata and execute arbitrary code.
Successful exploitation of the vulnerability allows to leverage SB2019022004.
Affected software
WordPress
wordpress (Debian package)
wordpress (Debian package)
How to mitigate CVE-2019-8942
The vulnerability has been addressed in the versions 4.9.9, 5.0.1.
WordPress - addressed in versions 4.9.9, 5.0.1
wordpress (Debian package) - update to 4.7.5+dfsg-2+deb9u5
wordpress (Debian package) - update to 4.7.5+dfsg-2+deb9u5