blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2008-5695

HIGH 8.5 CVSS 2.0
Published
December 19, 2008
Last modified
June 16, 2026
NVD status
Modified
Reported by
cve@mitre.org
Weakness
CWE-20
CVSS vector
AV:N/AC:M/Au:S/C:C/I:C/A:C

Description

wp-admin/options.php in WordPress MU before 1.3.2, and WordPress 2.3.2 and earlier, does not properly validate requests to update an option, which allows remote authenticated users with manage_options and upload_files capabilities to execute arbitrary code by uploading a PHP script and adding this script's pathname to active_plugins.

Affected WordPress components

  • WordPress core
    Confirmed match
    Up to and including 2.3.2

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • n/a n/a — Versions not specified
  • wordpress wordpress — Up to and including 2.3.2

References

  • mu.wordpress.org http://mu.wordpress.org/forums/topic.php?id=7534&page&replies=1 Release Notes, Vendor Advisory
  • secunia.com http://secunia.com/advisories/28789 Third Party Advisory
  • securityreason.com http://securityreason.com/securityalert/4798 Third Party Advisory
  • www.buayacorp.com http://www.buayacorp.com/files/wordpress/wordpress-mu-options-overwrite.html Exploit, Third Party Advisory
  • www.buayacorp.com http://www.buayacorp.com/files/wordpress/wp-blog-option-overwrite.txt Exploit, Third Party Advisory
  • www.securityfocus.com http://www.securityfocus.com/bid/27633 Third Party Advisory, VDB Entry
  • www.exploit-db.com https://www.exploit-db.com/exploits/5066 Exploit, Third Party Advisory, VDB Entry
  • nvd.nist.gov Official NVD record