WordPress CVE-2019-9787 Remote Code Execution Vulnerability

Bugtraq ID:	107411
Class:	Unknown
CVE:	CVE-2019-9787
Remote:	Yes
Local:	No
Published:	Mar 13 2019 12:00AM
Updated:	Mar 13 2019 12:00AM
Credit:	Simon Scannell
Vulnerable:	WordPress WordPress 5.0.3 WordPress WordPress 5.0.2 WordPress WordPress 4.9.9 WordPress WordPress 4.9.8 WordPress WordPress 4.9.7 WordPress WordPress 4.9.6 WordPress WordPress 4.9.5 WordPress WordPress 4.9.2 WordPress WordPress 4.9.1 WordPress WordPress 4.8.8 WordPress WordPress 4.8.3 WordPress WordPress 4.8.2 WordPress WordPress 4.8.1 WordPress WordPress 4.7.12 WordPress WordPress 4.7.4 WordPress WordPress 4.7.2 WordPress WordPress 4.7.1 WordPress WordPress 4.6.13 WordPress WordPress 4.6.1 WordPress WordPress 4.5.2 WordPress WordPress 4.5.1 WordPress WordPress 4.5 WordPress WordPress 4.4.1 WordPress WordPress 4.4 WordPress WordPress 4.2.22 WordPress WordPress 4.2.4 WordPress WordPress 4.2.3 WordPress WordPress 4.2.2 WordPress WordPress 4.2.1 WordPress WordPress 4.1.2 WordPress WordPress 4.1.1 WordPress WordPress 4.1 WordPress WordPress 3.9.2 WordPress WordPress 3.9.1 WordPress WordPress 3.9 WordPress WordPress 3.8.2 WordPress WordPress 3.8.1 WordPress WordPress 3.7.4 WordPress WordPress 3.7.1 WordPress WordPress 3.6.1 WordPress WordPress 3.6 WordPress WordPress 3.5.2 WordPress WordPress 3.5.1 WordPress WordPress 3.3.2 WordPress WordPress 3.1.3 WordPress WordPress 3.1.2 WordPress WordPress 3.1.1 WordPress WordPress 3.0.5 WordPress WordPress 3.0.4 WordPress WordPress 3.0.3 WordPress WordPress 3.0.2 WordPress WordPress 2.3.1 WordPress WordPress 1.3.1 WordPress WordPress 5.0.1 WordPress WordPress 5.0 WordPress WordPress 4.9 WordPress WordPress 4.7.5 WordPress WordPress 4.7.3 WordPress WordPress 4.7 WordPress WordPress 4.6 WordPress WordPress 4.5.3 WordPress WordPress 4.4.2 WordPress WordPress 4.3.1 WordPress WordPress 4.3 WordPress WordPress 4.2 WordPress WordPress 4.0.1 WordPress WordPress 4.0 WordPress WordPress 3.9.3 WordPress WordPress 3.9 WordPress WordPress 3.8.5 WordPress WordPress 3.8.4 WordPress WordPress 3.8.3 WordPress WordPress 3.8 WordPress WordPress 3.7.5 WordPress WordPress 3.7 WordPress WordPress 3.5.0 WordPress WordPress 3.5 WordPress WordPress 3.4.2 WordPress WordPress 3.4.1 WordPress WordPress 3.4 WordPress WordPress 3.3.3 WordPress WordPress 3.3.1 WordPress WordPress 3.3 WordPress WordPress 3.1 WordPress WordPress 3.0.6 WordPress WordPress 3.0.1 WordPress WordPress 1.3.3
Not Vulnerable:	WordPress WordPress 5.1.1

WordPress CVE-2019-9787 Remote Code Execution Vulnerability

WordPress is prone to a remote code-execution vulnerability.

Attackers can exploit this issue to execute arbitrary code in the context of the affected application. Failed exploit attempts will likely cause a denial-of-service condition.

Versions prior to WordPress 5.1.1 are vulnerable.

WordPress CVE-2019-9787 Remote Code Execution Vulnerability

The researcher who discovered this issue has created a proof-of-concept. Please see the references for more information.

WordPress CVE-2019-9787 Remote Code Execution Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

WordPress CVE-2019-9787 Remote Code Execution Vulnerability

References:

• Comments: Improve comment content filtering. (WordPress)
  
• Version 5.1.1 (WordPress)
  
• WordPress 5.1 CSRF to Remote Code Execution (ripstech.com)
  
• WordPress HomePage (WordPress)