WordPress CVEs

Description

Before version 4.8.2, WordPress allowed a Directory Traversal attack in the Customizer component via a crafted theme filename.

Affected WordPress components

• WordPress core
  Confirmed match
  Version 4.7; Version 4.7.1; Version 4.7.2; Version 4.7.3; Version 4.7.4; Version 4.7.5; Version 4.8; Version 4.8.1

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• n/a n/a — Versions not specified
• wordpress wordpress — Version 4.7
• wordpress wordpress — Version 4.7.1
• wordpress wordpress — Version 4.7.2
• wordpress wordpress — Version 4.7.3
• wordpress wordpress — Version 4.7.4
• wordpress wordpress — Version 4.7.5
• wordpress wordpress — Version 4.8
• wordpress wordpress — Version 4.8.1

References

• www.securityfocus.com http://www.securityfocus.com/bid/100912 Third Party Advisory, VDB Entry
• www.securitytracker.com http://www.securitytracker.com/id/1039553
• core.trac.wordpress.org https://core.trac.wordpress.org/changeset/41397 Patch, Vendor Advisory
• wordpress.org https://wordpress.org/news/2017/09/wordpress-4-8-2-security-and-maintenance-release/ Patch, Release Notes, Vendor Advisory
• wpvulndb.com https://wpvulndb.com/vulnerabilities/8912 Patch, Third Party Advisory
• www.debian.org https://www.debian.org/security/2017/dsa-3997
• nvd.nist.gov Official NVD record