CVE-2017-1000600
HIGHWordPress <4.9 - RCE
Title source: llmDescription
WordPress version <4.9 contains a CWE-20 Input Validation vulnerability in thumbnail processing that can result in remote code execution. This attack appears to be exploitable via thumbnail upload by an authenticated user and may require additional plugins in order to be exploited however this has not been confirmed at this time. This issue appears to have been partially, but not completely fixed in WordPress 4.9
Scores
CVSS v3
8.8
EPSS
0.2062
EPSS Percentile
95.5%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Classification
CWE
CWE-20
Status
published
Affected Products (1)
wordpress/wordpress
< 4.9
Timeline
Published
Sep 06, 2018
Tracked Since
Feb 18, 2026