PT-2007-4802 · Automattic · Wordpress Mu+1

Alexander Concha · Published 2007-07-03 · Updated 2013-09-08 · CVE-2007-3544

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions WordPress versions 2.2.1 WordPress MU version 1.2.3

Description The issue is related to an unrestricted file upload vulnerability. This allows remote authenticated users to upload and execute arbitrary PHP code. The vulnerability might be connected to the use of custom fields in normal posts and the wp postmeta table.

Recommendations For WordPress version 2.2.1, update to a version that includes a complete fix for the issue. For WordPress MU version 1.2.3, update to a version that includes a complete fix for the issue. As a temporary workaround, consider restricting file uploads to authorized users only until a patch is available.

Fix

Related Identifiers

CVE-2007-3544

Affected Products

Wordpress

Wordpress Mu

References · 7

• https://osv.dev/vulnerability/DEBIAN-CVE-2007-3544 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2007-3544 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2007-3544 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-3544 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3544 · Note
• http://buayacorp.com/files/wordpress/wordpress-advisory.html · Note
• http://osvdb.org/37294 · Note