Path Traversal Vulnerability in WordPress: CVE-2019-8943
Summary
DEBIAN-CVE-2019-8943: WordPress through 5.0.3 allows Path Traversal in wp_crop_image(). Affects wordpress versions 5.7.1+dfsg1-2 – 6.8.1+dfsg1-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
WordPress is a widely-used content management system (CMS) that allows users to create and manage websites easily. It offers a range of features including themes, plugins, and a user-friendly interface. However, like any software, it is not immune to vulnerabilities. CVE-2019-8943 is a specific vulnerability that affects WordPress versions up to 5.0.3, allowing attackers with image cropping privileges to exploit the system.
Vulnerability Detail
The vulnerability identified as CVE-2019-8943 allows for a Path Traversal attack through the wp_crop_image() function in WordPress. An attacker who has the ability to crop images can manipulate the filename to include multiple extensions and directory traversal sequences (e.g., ../) to write the output image to an arbitrary directory. This can lead to unauthorized file access and potential system compromise.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can restrict user permissions for cropping images to prevent unauthorized access until the software is updated. This can be done by adjusting user roles and capabilities in the WordPress admin panel.
Conclusion
CVE-2019-8943 is a significant vulnerability affecting WordPress versions up to 5.0.3, allowing for Path Traversal attacks. It is crucial for users to update their installations to the latest version to mitigate this risk. Additionally, employing tools like Vulert can help in monitoring for such vulnerabilities in real-time.
See every vulnerability recorded for wordpress →
FAQ
CVE-2019-8943 is a vulnerability in WordPress that allows attackers to exploit the wp_crop_image() function to perform Path Traversal attacks.
If you are running WordPress version 5.0.3 or earlier, your site is vulnerable. You can use tools like Vulert to check for vulnerabilities without needing to access the code.
The risks include unauthorized file access, potential data breaches, and the ability for attackers to execute malicious code on the server.
Yes, updating to the latest version of WordPress will patch this vulnerability.
You can use Vulert, which monitors open-source vulnerabilities in real-time using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for wordpress.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
