CVE-2019-9787

🗓️ 14 Mar 2019 16:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov👁 263 Views🌐 WEB

WordPress before 5.1.1 allows Remote Code Execution by unauthenticated users due to mishandled CSRF protection and incorrect Search Engine Optimization, leading to XSS and administrative access

Reporter	Title	Published	Views	Family All 63
GithubExploit	Exploit for Cross-Site Request Forgery (CSRF) in Wordpress	19 May 202022:09	–	githubexploit
GithubExploit	Exploit for Path Traversal in Wordpress	18 Aug 201904:50	–	githubexploit
GithubExploit	Exploit for Cross-Site Request Forgery (CSRF) in Wordpress	29 Jun 202108:57	–	githubexploit
BDU FSTEC	The vulnerability of the wp_ajax_replyto_comment function in ajax-actions.php and the wpHandleCommentSubmission function in comment.php of the WordPress content management system allows attackers to access confidential data, compromise its integrity, and cause service failures.	14 Aug 202000:00	–	bdu_fstec
CNVD	WordPress Cross-Site Request Forgery Vulnerability (CNVD-2020-28775)	15 Mar 201900:00	–	cnvd
Check Point Advisories	WordPress Core Remote Code Execution (CVE-2019-9787)	20 Nov 201900:00	–	checkpoint_advisories
Cvelist	CVE-2019-9787	14 Mar 201916:00	–	cvelist
Debian	[SECURITY] [DLA 1742-1] wordpress security update	31 Mar 201919:30	–	debian
Debian	[SECURITY] [DSA 4677-1] wordpress security update	6 May 202006:30	–	debian
Debian	[SECURITY] [DSA 4677-1] wordpress security update	6 May 202006:30	–	debian

NVD

Node

wordpress wordpressRange<5.1.1

Source	Link
blog	www.blog.ripstech.com/2019/wordpress-csrf-to-rce/
wordpress	www.wordpress.org/news/2019/03/wordpress-5-1-1-security-and-maintenance-release/
lists	www.lists.debian.org/debian-lts-announce/2019/03/msg00044.html
securityfocus	www.securityfocus.com/bid/107411
debian	www.debian.org/security/2020/dsa-4677
wordpress	www.wordpress.org/support/wordpress-version/version-5-1-1/
github	www.github.com/WordPress/WordPress/commit/0292de60ec78c5a44956765189403654fe4d080b
wpvulndb	www.wpvulndb.com/vulnerabilities/9230

Parameter	Position	Path	Description	CWE
comment	path	/wp-comments-post.php	CSRF to WordPress comment processing enabling XSS/RCE via unauthenticated or misconfigured protection.	CWE-352
comment_post_ID	path	/wp-comments-post.php	CSRF to WordPress comment processing enabling XSS/RCE via unauthenticated or misconfigured protection.	CWE-352
comment_parent	path	/wp-comments-post.php	CSRF to WordPress comment processing enabling XSS/RCE via unauthenticated or misconfigured protection.	CWE-352

17 Jun 2026 02:44Current

8.5High risk

Vulners AI Score8.5

CVSS 26.8

CVSS 38.8

EPSS0.4375

CWE-352