Skip to content
OpenAdvisories
Unscored Public exploit CVE-2018-12895 EUVD-2018-4848GHSA-v8xj-g4jr-hwhf

WordPress through 4.9.6 allows Author users to execute arbitrary code by leveraging directory traversal in the wp-admin/post.php thumb para…

Published Jun 26, 2018 · Updated Aug 5, 2024 · Assigned by mitre

Package: wordpress Package: wordpress Ecosystem: Debian Ecosystem: Ubuntu

Description

WordPress through 4.9.6 allows Author users to execute arbitrary code by leveraging directory traversal in the wp-admin/post.php thumb parameter, which is passed to the PHP unlink function and can delete the wp-config.php file. This is related to missing filename validation in the wp-includes/post.php wp_delete_attachment function. The attacker must have capabilities for files and posts that are normally available only to the Author, Editor, and Administrator roles. The attack methodology is to delete wp-config.php and then launch a new installation process to increase the attacker's privileges.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 wordpress 4.9.7+dfsg1-1 —
Debian 13 wordpress 4.9.7+dfsg1-1 —
Debian 12 wordpress 4.9.7+dfsg1-1 —
Debian 9 wordpress 4.7.5+dfsg-2+deb9u4 DSA-4250-1
Debian 8 wordpress 4.1+dfsg-1+deb8u18 DLA-1452-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 18.04 LTS wordpress No fix yet —
Ubuntu 16.04 LTS wordpress No fix yet —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Metasploit 1 module

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 2

References