What’s Vulnerable › Vulnerabilities

CVE-2019-8942

• Severity: high (CVSS 8.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 82.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-02-20 · updated 2026-06-17
• Weakness: CWE-434

Description

WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an _wp_attached_file Post Meta entry can be changed to an arbitrary string, such as one ending with a .jpg?file.php substring. An attacker with author privileges can execute arbitrary code by uploading a crafted image containing PHP code in the Exif metadata. Exploitation can leverage CVE-2019-8943.

Affected products

• Debian Linux: 9.0
• WordPress: before 4.9.9; 5.0, 5.0-beta1, 5.0-beta2, 5.0-beta3, 5.0-beta4, 5.0-beta5 (+3) — fixed in 4.9.9

How to fix

Upgrade to a fixed version: WordPress 4.9.9. Check the vendor advisory for mitigations.

References

• http://packetstormsecurity.com/files/152396/WordPress-5.0.0-crop-image-Shell-Upload.html
• http://www.rapid7.com/db/modules/exploit/multi/http/wp_crop_rce
• http://www.securityfocus.com/bid/107088
• https://blog.ripstech.com/2019/wordpress-image-remote-code-execution/
• https://lists.debian.org/debian-lts-announce/2019/03/msg00044.html
• https://wpvulndb.com/vulnerabilities/9222
• https://www.debian.org/security/2019/dsa-4401
• https://www.exploit-db.com/exploits/46511/
• https://www.exploit-db.com/exploits/46662/
• http://packetstormsecurity.com/files/152396/WordPress-5.0.0-crop-image-Shell-Upload.html
• http://www.rapid7.com/db/modules/exploit/multi/http/wp_crop_rce
• http://www.securityfocus.com/bid/107088

Get alerted when CVE-2019-8942 or the next vulnerability affects your stack