Remote Code Execution (RCE)

2020-06-1503:53:52

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.001 Low

EPSS

Percentile

43.5%

JSON

wordpress is vulnerable to remote code execution (RCE). The vulnerability exists as it allows users with upload permissions to upload files containing malicious scripts via the attachment, leading to an execution of malicious code when a user with higher privilege views the files.

CPENameOperatorVersion
johnpbloch/wordpressle5.4.1
johnpbloch/wordpressle4.3.23
johnpbloch/wordpressle4.4.22
johnpbloch/wordpressle4.2.27
johnpbloch/wordpressle5.2.6
johnpbloch/wordpressle5.3.3
johnpbloch/wordpressle4.6.18
johnpbloch/wordpressle5.0.9
johnpbloch/wordpressle3.8.33
johnpbloch/wordpressle4.8.13

Name	Operator	Version
johnpbloch/wordpress	le	5.4.1
johnpbloch/wordpress	le	4.3.23
johnpbloch/wordpress	le	4.4.22
johnpbloch/wordpress	le	4.2.27
johnpbloch/wordpress	le	5.2.6
johnpbloch/wordpress	le	5.3.3
johnpbloch/wordpress	le	4.6.18
johnpbloch/wordpress	le	5.0.9
johnpbloch/wordpress	le	3.8.33
johnpbloch/wordpress	le	4.8.13