#VU17803 Code injection in WordPress - CVE-2019-8942
Published: February 20, 2019 / Updated: March 1, 2019
Vulnerability identifier: #VU17803
Vulnerability risk: High
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Amber
CVE-ID: CVE-2019-8942
CWE-ID: CWE-94
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vulnerable software:
WordPress
WordPress
Software vendor:
WordPress.ORG
WordPress.ORG
Description
The vulnerability allows a remote attacker to execute PHP code on the target system.
The weakness exists due to an _wp_attached_file Post Meta entry can be changed to an arbitrary string, such as one ending with a .jpg?file.php substring. A remote attacker can upload a crafted image containing PHP code in the Exif metadata and execute arbitrary code.
Successful exploitation of the vulnerability allows to leverage SB2019022004.
The weakness exists due to an _wp_attached_file Post Meta entry can be changed to an arbitrary string, such as one ending with a .jpg?file.php substring. A remote attacker can upload a crafted image containing PHP code in the Exif metadata and execute arbitrary code.
Successful exploitation of the vulnerability allows to leverage SB2019022004.
Remediation
The vulnerability has been addressed in the versions 4.9.9, 5.0.1.