CVE-2007-1277
HIGH
7.5
CVSS 2.0
Description
WordPress 2.1.1, as downloaded from some official distribution sites during February and March 2007, contains an externally introduced backdoor that allows remote attackers to execute arbitrary commands via (1) an eval injection vulnerability in the ix parameter to wp-includes/feed.php, and (2) an untrusted passthru call in the iz parameter to wp-includes/theme.php.
Affected WordPress components
-
WordPress coreVersion 2.1.1
A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.
Affected products and versions
- n/a n/a — Versions not specified
- wordpress wordpress — Version 2.1.1
References
- ifsec.blogspot.com http://ifsec.blogspot.com/2007/03/wordpress-code-compromised-to-enable.html Exploit
- secunia.com http://secunia.com/advisories/24374 Vendor Advisory
- wordpress.org http://wordpress.org/development/2007/03/upgrade-212/ Vendor Advisory
- www.kb.cert.org http://www.kb.cert.org/vuls/id/214480 US Government Resource
- www.kb.cert.org http://www.kb.cert.org/vuls/id/641456 US Government Resource
- www.securityfocus.com http://www.securityfocus.com/archive/1/461794/100/0/threaded
- www.securityfocus.com http://www.securityfocus.com/bid/22797
- www.vupen.com http://www.vupen.com/english/advisories/2007/0812
- exchange.xforce.ibmcloud.com https://exchange.xforce.ibmcloud.com/vulnerabilities/32804
- exchange.xforce.ibmcloud.com https://exchange.xforce.ibmcloud.com/vulnerabilities/32807
- nvd.nist.gov Official NVD record