CVE-2019-8942

CVE-2019-8942 and CVE-2019-8943: WordPress RCE author privilege Overview CVE-2019-8942 is a vulnerability that exploits an LFI flaw combined with the File Upload feature to achieve RCE on a WordPress web server with author privileges. Affected WordPress versions include those before 4.9.9 and 5.x...

WordPress < 5.0.4 Directory Traversal Vulnerability

According to its self-reported version number, the WordPress application running on the remote web server is prior to 5.0.4. It is, therefore, affected by a directory traversal vulnerability in its wpcropimage component. An authenticated, remote attacker can exploit this, by sending a URI that...

DEBIAN-CVE-2019-8943

WordPress through 5.0.3 allows Path Traversal in wpcropimage. An attacker who has privileges to crop an image can write the output image to an arbitrary directory via a filename containing two image extensions and ../ sequences, such as a filename ending with the .jpg?/../../file.jpg substring...