Description
Direct static code injection vulnerability in WordPress 2.0.2 and earlier allows remote attackers to execute arbitrary commands by inserting a carriage return and PHP code when updating a profile, which is appended after a special comment sequence into files in (1) wp-content/cache/userlogins/ (2) wp-content/cache/users/ which are later included by cache.php, as demonstrated using the displayname argument.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | wordpress | 2.0.3-1 | — |
| Debian 13 | wordpress | 2.0.3-1 | — |
| Debian 12 | wordpress | 2.0.3-1 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- WordPress Core 2.0.2 - 'cache' Remote Shell Injection EDB-6 · webapps · May 25, 2006 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 20271 third-party-advisory
- 25777 vdb-entry
- ADV-2006-1992 vdb-entry
- 20608 third-party-advisory
- GLSA-200606-08 vendor-advisory
- 18372 vdb-entry
- wordpress-user-profile-code-injection(26687) vdb-entry
- http://retrogod.altervista.org/wordpress_202_xpl.html
- 20060525 Wordpress <=2.0.2 'cache' shell injection mailing-list