CVE-2009-3890: Code Injection
Unrestricted file upload vulnerability in the wpcheckfiletype function in wp-includes/functions.php in WordPress before 2.8.6, when a certain configuration of the modmime module in the Apache HTTP Server is enabled, allows remote authenticated users to execute arbitrary code by posting an attachment with a multiple-extension filename, and then accessing this attachment via a direct request to a wp-content/uploads/ pathname, as demonstrated by a .php.jpg filename.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2009-3890?
CVE-2009-3890 has a high severity due to its potential to allow remote authenticated users to execute arbitrary code.
How do I fix CVE-2009-3890?
To fix CVE-2009-3890, upgrade WordPress to version 2.8.6 or later.
Who is affected by CVE-2009-3890?
CVE-2009-3890 affects users of WordPress versions prior to 2.8.6 with specific Apache mod_mime configurations.
What type of vulnerability is CVE-2009-3890?
CVE-2009-3890 is classified as an unrestricted file upload vulnerability.
Can CVE-2009-3890 be exploited without authentication?
No, CVE-2009-3890 requires remote authenticated users to exploit the vulnerability.