Description
Unrestricted file upload vulnerability in WordPress 2.5.1 and earlier might allow remote authenticated administrators to upload and execute arbitrary PHP files via the Upload section in the Write Tabs area of the dashboard.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | wordpress | 2.5.1-4 | — |
| Debian 13 | wordpress | 2.5.1-4 | — |
| Debian 12 | wordpress | 2.5.1-4 | — |
References
- 3897 third-party-advisory
- 20080519 Wordpress Malicious File Execution Vulnerability mailing-list
- 29276 vdb-entry
- wordpress-writetabs-file-upload(42561) vdb-entry