CVE-2007-3544

published 2007-07-03

CVE-2007-3544: Unrestricted file upload vulnerability in (1) wp-app.php and (2) app.php in WordPress 2.2.1 and WordPress MU 1.2.3 allows remote authenticated users to upload…

Priority P4 28 medium 6.5 CVSS 2.0

AV N AC L Au S C P I P A P

Unrestricted file upload vulnerability in (1) wp-app.php and (2) app.php in WordPress 2.2.1 and WordPress MU 1.2.3 allows remote authenticated users to upload and execute arbitrary PHP code via unspecified vectors, possibly related to the wp_postmeta table and the use of custom fields in normal (non-attachment) posts. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2007-3543.

Affected

7 ranges

Vendor	Product	Version range	Fixed in
debian	wordpress	< wordpress 2.2.2-1 (bookworm)	wordpress 2.2.2-1 (bookworm)
wordpress	wordpress	<= 2.2.0	—
wordpress	wordpress	>= 0 < 2.2.2-1	2.2.2-1
wordpress	wordpress	>= 0 < 2.2.2-1	2.2.2-1
wordpress	wordpress	>= 0 < 2.2.2-1	2.2.2-1
wordpress	wordpress	>= 0 < 2.2.2-1	2.2.2-1
wordpress	wordpress_mu	<= 1.2.2	—

CVSS provenance

nvd v2.0 6.5 MEDIUM AV:N/AC:L/Au:S/C:P/I:P/A:P

osv 6.0 MEDIUM

vendor_debian 6.0 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.