VulnerabilityModified

CVE-2008-5695

wp-admin/options.php in WordPress MU before 1.3.2, and WordPress 2.3.2 and earlier, does not properly validate requests to update an option, which allows remote authenticated users with manage_options and upload_files capabilities to execute arbitrary…

HIGH 8.5EPSS 12.0%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 12.0%, higher than 96% of all known CVEs. Patch or mitigate before the next change window.

Description

CVSS 2.0: 8.5 HIGHAV:N/AC:M/Au:S/C:C/I:C/A:C
EPSS: 12.01% probability · 96th percentile
CISA KEV: Not listed
Weakness: CWE-20
Affected: wordpress/wordpress · wordpress/wordpress mu
Source: cve@mitre.org

References

http://mu.wordpress.org/forums/topic.php?id=7534&page&replies=1Release Notes, Vendor Advisory
http://secunia.com/advisories/28789Third Party Advisory
http://securityreason.com/securityalert/4798Third Party Advisory
http://www.buayacorp.com/files/wordpress/wordpress-mu-options-overwrite.htmlExploit, Third Party Advisory
http://www.buayacorp.com/files/wordpress/wp-blog-option-overwrite.txtExploit, Third Party Advisory
http://www.securityfocus.com/bid/27633Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/5066Exploit, Third Party Advisory, VDB Entry
http://mu.wordpress.org/forums/topic.php?id=7534&page&replies=1Release Notes, Vendor Advisory
http://secunia.com/advisories/28789Third Party Advisory
http://securityreason.com/securityalert/4798Third Party Advisory
http://www.buayacorp.com/files/wordpress/wordpress-mu-options-overwrite.htmlExploit, Third Party Advisory
http://www.buayacorp.com/files/wordpress/wp-blog-option-overwrite.txtExploit, Third Party Advisory
http://www.securityfocus.com/bid/27633Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/5066Exploit, Third Party Advisory, VDB Entry

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.