PT-2007-2694 · WordPress · Wordpress

Published 2007-03-05 · Updated 2018-10-16 · CVE-2007-1277

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions WordPress version 2.1.1

Description The issue allows remote attackers to execute arbitrary commands. This is achieved through an eval injection vulnerability in the ix parameter to "wp-includes/feed.php" and an untrusted passthru call in the iz parameter to "wp-includes/theme.php".

Recommendations For WordPress version 2.1.1, consider removing or restricting access to the affected files "wp-includes/feed.php" and "wp-includes/theme.php" to minimize the risk of exploitation. Avoid using the ix and iz parameters in the respective API endpoints until the issue is resolved.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2007-1277

Affected Products

Wordpress

References · 14

• 🔥 http://ifsec.blogspot.com/2007/03/wordpress-code-compromised-to-enable.html · Exploit
• 🔥 https://exploit-db.com/exploits/29701 · Exploit
• 🔥 https://exploit-db.com/exploits/29702 · Exploit
• http://secunia.com/advisories/24374 · Vendor Advisory
• http://wordpress.org/development/2007/03/upgrade-212 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-1277 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/32807 · Note
• http://kb.cert.org/vuls/id/214480 · Note
• http://securityfocus.com/bid/22797 · Note
• http://vupen.com/english/advisories/2007/0812 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/32804 · Note
• http://securityfocus.com/archive/1/461794/100/0/threaded · Note
• http://kb.cert.org/vuls/id/641456 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1277 · Note