WordPress

What this is

WordPress uses predictable temporary locations reachable over the Internet while updating its core from a complete package. This can let an attacker run their own program on the server during the update.

How it can harm you

An attacker can run their own program on your server without signing in while a full core update is underway. Successfully exploiting this requires difficult conditions; the precise timing and other requirements are not specified.

How urgent it is

This vulnerability is already being used in attacks. Update WordPress to a release confirmed by the vendor to correct the problem, because a full core update can expose the server to someone running their own program.

Who is affected

Affected WordPress versions, including both ends of each range: 4.7.0–4.7.38; 4.8.0–4.8.33; 4.9.0–4.9.34; 5.0.0–5.0.30; 5.1.0–5.1.27; 5.2.0–5.2.29; 5.3.0–5.3.26; 5.4.0–5.4.24; 5.5.0–5.5.23; 5.6.0–5.6.22; 5.7.0–5.7.20; 5.8.0–5.8.18; 5.9.0–5.9.19; 6.0.0–6.0.17; 6.1.0–6.1.15; 6.2.0–6.2.14; 6.3.0–6.3.13; 6.4.0–6.4.13; 6.5.0–6.5.13; 6.6.0–6.6.10; 6.7.0–6.7.10; 6.8.0–6.8.11; 6.9.0–6.9.10; 7.0.0–7.0.7; 7.1.0–7.1.3.

What to do

Consult the WordPress Foundation advisory and update WordPress to a release confirmed to correct the problem. For the corresponding affected branch, that release must be newer than its affected limit: 4.7.38; 4.8.33; 4.9.34; 5.0.30; 5.1.27; 5.2.29; 5.3.26; 5.4.24; 5.5.23; 5.6.22; 5.7.20; 5.8.18; 5.9.19; 6.0.17; 6.1.15; 6.2.14; 6.3.13; 6.4.13; 6.5.13; 6.6.10; 6.7.10; 6.8.11; 6.9.10; 7.0.7; 7.1.3. Specific fixed releases are not identified.

How to check your server

Check which WordPress version is installed and compare it with the affected ranges and corrected releases listed in the WordPress Foundation advisory.

Check your server for free →