CVE-2008-2392

WordPress < 2.5.1 - Authenticated Arbitrary File Upload via Dashboard Upload Section

Title source: llm
STIX 2.1

Description

Unrestricted file upload vulnerability in WordPress 2.5.1 and earlier might allow remote authenticated administrators to upload and execute arbitrary PHP files via the Upload section in the Write Tabs area of the dashboard.

References (4)

Core 4
Core References
Third Party Advisory third-party-advisory x_refsource_sreason
http://securityreason.com/securityalert/3897
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/492230/100/0/threaded
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/29276
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/42561

Scores

EPSS 0.0193
EPSS Percentile 83.6%

Details

CWE
CWE-20
Status published
Products (1)
wordpress/wordpress < 2.5.1
Published May 21, 2008
Tracked Since Feb 18, 2026