WordPress Core < 5.0.1 - Arbitrary File Deletion
2018-12-12 00:00
Karim El OuerghemmiStrategic Overview
StatusPatched in 3.7.28
Affected CoreWordPress 5.0
Affected Version
3.7 – 5.0 · 15 branchesCVSS7.7High
CVE
CVE-2018-20147Vulnerability Overview
In WordPress before 4.9.9 and 5.x before 5.0.1, authors could modify metadata to bypass intended restrictions on deleting files.
Technical Analysis
REMEDIATION: Update to one of the following versions, or a newer patched version: 3.7.28, 3.8.28, 3.9.26, 4.0.25, 4.1.25, 4.2.22, 4.3.18, 4.4.17, 4.5.16, 4.6.13, 4.7.12, 4.8.8, 4.9.9, 5.0.1 --- IDENTIFIER: CWE-285 (Improper Authorization) The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C