CWE Code: 94
Vulnerability Type: privilege_escalation
CVSS Score: 6.5
CWE Name:  Improper Control of Generation of Code ('Code Injection')
Summary: wordpress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an _wp_attached_file post meta entry can be changed to an arbitrary string, such as one ending with a .jpg?file.php substring. an attacker with author privileges can execute arbitrary code by uploading a crafted image containing php code in the exif metadata. exploitation can leverage cve-2019-8943.
Access Authentication: SINGLE
Access Complexity: LOW
Access Vector: NETWORK
Impact (C/I/A): PARTIAL/PARTIAL/PARTIAL
Published Date: 2019-02-20
Last Modified Date: 2019-04-25