Description

WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an _wp_attached_file Post Meta entry can be changed to an arbitrary string, such as one ending with a .jpg?file.php substring. An attacker with author privileges can execute arbitrary code by uploading a crafted image containing PHP code in the Exif metadata. Exploitation can leverage CVE-2019-8943.

Remediation

References

CVE-2019-8942

Related Vulnerabilities

MySQL CVE-2016-0646 Vulnerability (CVE-2016-0646)

WordPress Plugin Email Verification for WooCommerce Unspecified Vulnerability (1.8.1)

Jenkins Incorrect Permission Assignment for Critical Resource Vulnerability (CVE-2017-2612)

Jboss EAP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2011-4610)

WordPress Plugin Redirection HTTP Referrer Header HTML Injection (2.2.9)

Severity

High

Classification

CVE-2019-8942 CWE-94 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities