CVE-2007-3544

Severity: medium (CVSS 6.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2007-07-03 · updated 2026-06-16

Description

Unrestricted file upload vulnerability in (1) wp-app.php and (2) app.php in WordPress 2.2.1 and WordPress MU 1.2.3 allows remote authenticated users to upload and execute arbitrary PHP code via unspecified vectors, possibly related to the wp_postmeta table and the use of custom fields in normal (non-attachment) posts. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2007-3543.

Affected products

WordPress: through 2.2.0
Wordpress Mu: through 1.2.2

References

http://osvdb.org/37294
http://www.buayacorp.com/files/wordpress/wordpress-advisory.html
http://osvdb.org/37294
http://www.buayacorp.com/files/wordpress/wordpress-advisory.html

Get alerted when CVE-2007-3544 or the next vulnerability affects your stack