CWE Code: 22
Vulnerability Type: privilege_escalation
CVSS Score: 6.5
CWE Name:  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Summary: wordpress through 4.9.6 allows author users to execute arbitrary code by leveraging directory traversal in the wp-admin/post.php thumb parameter, which is passed to the php unlink function and can delete the wp-config.php file. this is related to missing filename validation in the wp-includes/post.php wp_delete_attachment function. the attacker must have capabilities for files and posts that are normally available only to the author, editor, and administrator roles. the attack methodology is to delete wp-config.php and then launch a new installation process to increase the attacker's privileges.
Access Authentication: SINGLE
Access Complexity: LOW
Access Vector: NETWORK
Impact (C/I/A): PARTIAL/PARTIAL/PARTIAL
Published Date: 2018-06-26
Last Modified Date: 2018-08-20