CyberRota Analysis
This is a high severity vulnerability with a CVSS score of 8.8. It affects WordPress. Public exploit code or proof-of-concept references have been detected in its references. It may be remotely exploitable. Exploitation may require the attacker to be authenticated.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
WordPress version <4.9 contains a CWE-20 Input Validation vulnerability in thumbnail processing that can result in remote code execution. This attack appears to be exploitable via thumbnail upload by an authenticated user and may require additional plugins in order to be exploited however this has not been confirmed at this time. This issue appears to have been partially, but not completely fixed in WordPress 4.9
Related CVEs
Other vulnerabilities affecting the same vendor(s)