CVE-2007-1277 WordPress Core 2.2.1 - Backdoor
HighCVSS 7.5
EPSS 27.8%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
WordPress 2.1.1, as downloaded from some official distribution sites during February and March 2007, contains an externally introduced backdoor that allows remote attackers to execute arbitrary commands via (1) an eval injection vulnerability in the ix parameter to wp-includes/feed.php, and (2) an untrusted passthru call in the iz parameter to wp-includes/theme.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| WordPress | = 2.1.1 | No fix listed |
| WordPress(WordPress) | = 2.2.1 | No fix listed |
References
- ifsec.blogspot.com exploit
- 24374 third-party-advisory vendor-advisory
- wordpress.org vendor-advisory
- VU#214480 third-party-advisory us-government-resource
- VU#641456 third-party-advisory us-government-resource
- 20070303 WordPress source code compromised to enable remote code execution mailing-list
- 22797 vdb-entry
- ADV-2007-0812 vdb-entry
- wordpress-feed-code-execution(32804) vdb-entry
- wordpress-theme-command-execution(32807) vdb-entry
- Wordfence Intelligence third-party-advisory
- www.cve.org
- Debian Security Tracker CVE-2007-1277 vendor-advisory