Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

WordPress < 2.0.3 Arbitrary Code Injection

High

Synopsis

The remote host is vulnerable to an arbitrary 'command insertion' flaw.

Description

The remote WordPress application is vulnerable to an arbitrary 'code injection' flaw. The application fails to sanitize cached 'username' data. An attacker exploiting this flaw would send a malformed request to the WordPress application. Successful exploitation would result in the attacker running arbitrary commands with the permission of the WordPress application.

Solution

Upgrade to WordPress 2.0.3, or later.