Public exploit available

Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2005-2612 — Code Injection in Wordpress

6 documents6 sources

Severity

7.5HIGHNVD

EPSS

73.4%

top 1.19%

CISA KEV

Not in KEV

Exploit

PoC available

Public exploit / PoC exists

Affected products

Wordpress Debian Wordpress

Timeline

PublishedAug 17

Latest updateMay 1

Description

Direct code injection vulnerability in WordPress 1.5.1.3 and earlier allows remote attackers to execute arbitrary PHP code via the cache_lastpostdate[server] cookie.

CVSS vector

AV:N/AC:L/C:P/I:P/A:PExploitability: 10.0 | Impact: 6.4

Affected Packages3 packages

▶debiandebian/wordpress< wordpress 1.5.2-1 (bookworm)

▶Debianwordpress/wordpress< 1.5.2-1+3

▶NVDwordpress/wordpress8 versions+7

🔴Vulnerability Details

GHSA

GHSA-73gj-5f8g-vq97: Direct code injection vulnerability in WordPress 1↗2022-05-01

▶

OSV

CVE-2005-2612: Direct code injection vulnerability in WordPress 1↗2005-08-17

▶

💥Exploits & PoCs

Exploit-DB

WordPress Core 1.5.1.3 - 'cache_lastpostdate' Arbitrary Code Execution (Metasploit)↗2010-07-03

▶

Metasploit

WordPress cache_lastpostdate Arbitrary Code Execution↗

▶

📋Vendor Advisories

Debian

CVE-2005-2612: wordpress - Direct code injection vulnerability in WordPress 1.5.1.3 and earlier allows remo...↗2005

▶