Description

wp-includes/functions.php in WordPress before 3.6.1 does not properly determine whether data has been serialized, which allows remote attackers to execute arbitrary code by triggering erroneous PHP unserialize operations.

Remediation

References

CVE-2013-4338

Related Vulnerabilities

WordPress Plugin Ninja Forms Contact Form-The Drag and Drop Form Builder for WordPress Multiple Vulnerabilities (3.4.34)

PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2011-1938)

WordPress Plugin LearnPress-WordPress LMS Local File Inclusion (4.2.6.8.2)

WordPress Plugin Live Scores for SportsPress Multiple Vulnerabilities (1.9.0)

WordPress Plugin Photo Gallery by 10Web-Mobile-Friendly Image Gallery Arbitrary File Upload (1.2.5)

Severity

High

Classification

CVE-2013-4338 CWE-94

Tags

Missing Update Known Vulnerabilities