CVE-2019-8942: Malicious File Upload
WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an wpattachedfile Post Meta entry can be changed to an arbitrary string, such as one ending with a .jpg?file.php substring. An attacker with author privileges can execute arbitrary code by uploading a crafted image containing PHP code in the Exif metadata. Exploitation can leverage CVE-2019-8943.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/wordpressto a version that resolves this vulnerability.Fixed in 5.0.15+dfsg1-0+deb10u1Fixed in 5.0.19+dfsg1-0+deb10u1Fixed in 5.7.8+dfsg1-0+deb11u2Fixed in 6.1.1+dfsg1-1Fixed in 6.3.1+dfsg1-1
Event History
Frequently Asked Questions
What is the severity of CVE-2019-8942?
CVE-2019-8942 is classified as a high severity vulnerability due to the potential for remote code execution.
How do I fix CVE-2019-8942?
To fix CVE-2019-8942, upgrade WordPress to the latest version that is patched for this vulnerability.
Who is affected by CVE-2019-8942?
CVE-2019-8942 affects WordPress versions prior to 4.9.9 and 5.0.1, including all beta and release candidate versions.
What type of vulnerability is CVE-2019-8942?
CVE-2019-8942 is a remote code execution vulnerability that allows an attacker to execute arbitrary code on the server.
What can attackers do with CVE-2019-8942?
Attackers with author privileges can exploit CVE-2019-8942 to upload malicious files disguised as images, leading to code execution.