Detections
Analytics
WordPress < 2.8.6 Multiple Vulnerabilities
medium Nessus Plugin ID 42801
Language:
Synopsis
The remote web server contains a PHP application that is affected by multiple vulnerabilities.Description
According to its version number, the installation of WordPress is affected by multiple vulnerabilities :- It is possible for an attacker with valid credentials to upload arbitrary files, resulting in arbitrary code execution.
- A cross-site scripting vulnerability exists in 'Press-This'.
Solution
Upgrade to WordPress 2.8.6 or later.See Also
http://www.nessus.org/u?c5090570
https://www.securityfocus.com/archive/1/507819/30/0/threaded
Plugin Details
Severity: Medium
ID: 42801
File Name: wordpress_2_8_6.nasl
Version: 1.20
Type: remote
Family: CGI abuses
Published: 11/13/2009
Updated: 1/19/2021
Configuration: Enable paranoid mode
Supported Sensors: Nessus
Risk Information
CVSS v2
Risk Factor: Medium
Base Score: 6.5
Temporal Score: 4.8
Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P
Vulnerability Information
CPE: cpe:/a:wordpress:wordpress
Required KB Items: installed_sw/WordPress, www/PHP, Settings/ParanoidReport
Exploit Ease: No known exploits are available
Patch Publication Date: 11/11/2009
Vulnerability Publication Date: 11/11/2009