CVE-2008-5695: Input Validation
wp-admin/options.php in WordPress MU before 1.3.2, and WordPress 2.3.2 and earlier, does not properly validate requests to update an option, which allows remote authenticated users with manageoptions and uploadfiles capabilities to execute arbitrary code by uploading a PHP script and adding this script's pathname to activeplugins.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Revoke the 'upload_files' capability from any roles or users that do not require it. Use a capability-management plugin or call remove_cap() for the specific roles (e.g., remove_cap('role','upload_files')) so only trusted accounts can upload files.
WordPress roles/capabilities upload_files = remove from untrusted roles/users - Configuration
Ensure the 'manage_options' capability is assigned only to trusted administrator accounts. Remove this capability from non-admin or untrusted accounts using a capability-management plugin or by adjusting role definitions (e.g., remove_cap('role','manage_options')).
WordPress roles/capabilities manage_options = limit to trusted administrators - Compensating control
Prevent execution of uploaded PHP by configuring the web server to disallow PHP execution in upload directories (for example, disable PHP handler or add rules to deny .php execution in wp-content/uploads via .htaccess or equivalent Nginx configuration).
- Operational
Audit the active_plugins option and the uploads directory for malicious entries/files: inspect the options table (option_name = 'active_plugins') for any plugin paths pointing to uploaded PHP files and remove such entries; scan wp-content/uploads for .php files and delete any unauthorized PHP files.
Event History
Frequently Asked Questions
What is the severity of CVE-2008-5695?
CVE-2008-5695 is classified as a critical vulnerability due to its potential for remote code execution.
How do I fix CVE-2008-5695?
To fix CVE-2008-5695, upgrade to WordPress version 2.3.3 or later, or WordPress MU version 1.3.2 or later.
Who is affected by CVE-2008-5695?
CVE-2008-5695 affects remote authenticated users with manage_options and upload_files capabilities in WordPress and WordPress MU.
What can an attacker do with CVE-2008-5695?
An attacker can execute arbitrary code by uploading a malicious PHP script due to the inadequate validation of requests.
When was CVE-2008-5695 reported?
CVE-2008-5695 was reported in late 2008, impacting specific versions of WordPress MU and WordPress.