CVE-2007-3544: Medium severity WordPress WordPress vulnerability
Unrestricted file upload vulnerability in (1) wp-app.php and (2) app.php in WordPress 2.2.1 and WordPress MU 1.2.3 allows remote authenticated users to upload and execute arbitrary PHP code via unspecified vectors, possibly related to the wppostmeta table and the use of custom fields in normal (non-attachment) posts. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2007-3543.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2007-3544?
CVE-2007-3544 has a critical severity level due to the potential for arbitrary code execution on vulnerable WordPress sites.
How do I fix CVE-2007-3544?
To fix CVE-2007-3544, you should upgrade WordPress to version 2.2.1 or later and ensure all plugins are updated.
What versions of WordPress are affected by CVE-2007-3544?
CVE-2007-3544 affects WordPress versions up to 2.2.0 and WordPress MU versions up to 1.2.2.
Can CVE-2007-3544 be exploited remotely?
Yes, CVE-2007-3544 can be exploited remotely by authenticated users to upload and execute malicious PHP code.
What types of users are at risk with CVE-2007-3544?
Authenticated users with upload privileges on affected WordPress versions are at risk from CVE-2007-3544.