Vulnerability Details : CVE-2018-1000773
WordPress version 4.9.8 and earlier contains a CWE-20 Input Validation vulnerability in thumbnail processing that can result in remote code execution due to an incomplete fix for CVE-2017-1000600. This attack appears to be exploitable via thumbnail upload by an authenticated user and may require additional plugins in order to be exploited however this has not been confirmed at this time.
Vulnerability category: Input validationExecute code
Threat overview for CVE-2018-1000773
Top countries where our scanners detected CVE-2018-1000773
Top open port discovered on systems with this issue 80
IPs affected by CVE-2018-1000773 48
Threat actors abusing to this issue? Yes
Find out if you* are affected by CVE-2018-1000773!
*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.
Exploit prediction scoring system (EPSS) score for CVE-2018-1000773
Probability of exploitation activity in the next 30 days: 1.06%
CVSS scores for CVE-2018-1000773
|Base Score||Base Severity||CVSS Vector||Exploitability Score||Impact Score||Source|
CWE ids for CVE-2018-1000773
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by: email@example.com (Primary)
References for CVE-2018-1000773
WordPress CVE-2018-1000773 Incomplete Fix Arbitrary File Upload VulnerabilityThird Party Advisory;VDB Entry
BSidesMCR 2018: It's A PHP Unserialization Vulnerability Jim, But Not As We Know It by Sam Thomas - YouTubeThird Party Advisory
So phar, so FUD: PHP flaw puts WordPress sites at risk of hacks • The RegisterThird Party Advisory