CVE-2014-5203

WordPress 3.9.x - Remote Code Execution via Serialized Data

Title source: llm
STIX 2.1

Description

wp-includes/class-wp-customize-widgets.php in the widget implementation in WordPress 3.9.x before 3.9.2 might allow remote attackers to execute arbitrary code via crafted serialized data.

References (3)

Core 3
Core References
Patch, Vendor Advisory x_refsource_confirm
https://wordpress.org/news/2014/08/wordpress-3-9-2/
Mailing List mailing-list x_refsource_mlist
http://openwall.com/lists/oss-security/2014/08/13/3

Scores

EPSS 0.0644
EPSS Percentile 91.2%

Details

Status published
Products (2)
wordpress/wordpress 3.9.0
wordpress/wordpress 3.9.1
Published Aug 18, 2014
Tracked Since Feb 18, 2026