Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an _wp_attached_file Post Meta entry can be changed to an arbitrary string, such as one ending with a .jpg?file.php substring. An attacker with author privileges can execute arbitrary code by uploading a crafted image containing PHP code in the Exif metadata. Exploitation can leverage CVE-2019-8943.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
2 versions affected across 2 products
@batuhan @HSVSphere next.js is running tiktok, netflix and twitch, so not sure what your argument is supposed to be here. WordPress itself also had some horrible security issues (CVE-2017-1001000, CVE-2019-8942)
Post summary
The tweet simply references two WordPress CVEs without giving any technical, exploit, patch, or exploitation context.
11 of 11 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| OS | debian | debian_linux | 9.0 | - | - |
| App | wordpress | wordpress | - | - | - |
| App | wordpress | wordpress | 5.0 | - | - |
| App | wordpress | wordpress | 5.0 | - | - |
| App | wordpress | wordpress | 5.0 | - | - |
| App | wordpress | wordpress | 5.0 | - | - |
| App | wordpress | wordpress | 5.0 | - | - |
| App | wordpress | wordpress | 5.0 | - | - |
| App | wordpress | wordpress | 5.0 | - | - |
| App | wordpress | wordpress | 5.0 | - | - |
| App | wordpress | wordpress | 5.0 | - | - |