p PatchFirst

CVE-2007-3543

CVE-2007-3543

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Unrestricted file upload vulnerability in WordPress before 2.2.1 and WordPress MU before 1.2.3 allows remote authenticated users to upload and execute arbitrary PHP code by making a post that specifies a .php filename in the _wp_attached_file metadata field; and then sending this file's content, along with its post_ID value, to (1) wp-app.php or (2) app.php.

EPSS 1.6% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • wordpress Debian:12

    Affected ranges
    • ECOSYSTEM: < 2.2.1-1

    Update to 2.2.1-1

  • wordpress Debian:13

    Affected ranges
    • ECOSYSTEM: < 2.2.1-1

    Update to 2.2.1-1

  • wordpress Debian:14

    Affected ranges
    • ECOSYSTEM: < 2.2.1-1

    Update to 2.2.1-1

Original sources

Check your server →