Vulnerability Description
WordPress 2.1.1, as downloaded from some official distribution sites during February and March 2007, contains an externally introduced backdoor that allows remote attackers to execute arbitrary commands via (1) an eval injection vulnerability in the ix parameter to wp-includes/feed.php, and (2) an untrusted passthru call in the iz parameter to wp-includes/theme.php.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Wordpress | Wordpress | 2.1.1 |
Related Weaknesses (CWE)
References
- http://ifsec.blogspot.com/2007/03/wordpress-code-compromised-to-enable.htmlExploit
- http://secunia.com/advisories/24374Vendor Advisory
- http://wordpress.org/development/2007/03/upgrade-212/Vendor Advisory
- http://www.kb.cert.org/vuls/id/214480US Government Resource
- http://www.kb.cert.org/vuls/id/641456US Government Resource
- http://www.securityfocus.com/archive/1/461794/100/0/threaded
- http://www.securityfocus.com/bid/22797
- http://www.vupen.com/english/advisories/2007/0812
- https://exchange.xforce.ibmcloud.com/vulnerabilities/32804
- https://exchange.xforce.ibmcloud.com/vulnerabilities/32807
- http://ifsec.blogspot.com/2007/03/wordpress-code-compromised-to-enable.htmlExploit
- http://secunia.com/advisories/24374Vendor Advisory
- http://wordpress.org/development/2007/03/upgrade-212/Vendor Advisory
- http://www.kb.cert.org/vuls/id/214480US Government Resource
- http://www.kb.cert.org/vuls/id/641456US Government Resource
FAQ
What is CVE-2007-1277?
CVE-2007-1277 is a vulnerability with a CVSS score of 7.5 (HIGH). WordPress 2.1.1, as downloaded from some official distribution sites during February and March 2007, contains an externally introduced backdoor that allows remote attackers to execute arbitrary comman...
How severe is CVE-2007-1277?
CVE-2007-1277 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2007-1277?
Check the references section above for vendor advisories and patch information. Affected products include: Wordpress Wordpress.