Read the docs
TI-2019-06452 Aliases CVE-2019-8942GHSA-rwhm-6hw4-9fgg

WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an…

Priority HIGH 79CWE-434Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-434.

Summary

WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an _wp_attached_file Post Meta entry can be changed to an arbitrary string, such as one ending with a .jpg?file.php substring. An attacker with author privileges can execute arbitrary code by uploading a crafted image containing PHP code in the Exif metadata. Exploitation can leverage CVE-2019-8943.

Why it matters now

EPSS 0.82736 99th percentileScored 2026-11-07
Public exploit Yes 5 exploit referencesTagged by the CNA and NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 11

CPEVersionsRoleVendor
cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*before 4.9.9VulnerableWordPress
cpe:2.3:a:wordpress:wordpress:5.0:-:*:*:*:*:*:*5.0VulnerableWordPress
cpe:2.3:a:wordpress:wordpress:5.0:beta1:*:*:*:*:*:*5.0 beta1VulnerableWordPress
cpe:2.3:a:wordpress:wordpress:5.0:beta2:*:*:*:*:*:*5.0 beta2VulnerableWordPress
cpe:2.3:a:wordpress:wordpress:5.0:beta3:*:*:*:*:*:*5.0 beta3VulnerableWordPress
cpe:2.3:a:wordpress:wordpress:5.0:beta4:*:*:*:*:*:*5.0 beta4VulnerableWordPress
cpe:2.3:a:wordpress:wordpress:5.0:beta5:*:*:*:*:*:*5.0 beta5VulnerableWordPress
cpe:2.3:a:wordpress:wordpress:5.0:rc1:*:*:*:*:*:*5.0 rc1VulnerableWordPress
cpe:2.3:a:wordpress:wordpress:5.0:rc2:*:*:*:*:*:*5.0 rc2VulnerableWordPress
cpe:2.3:a:wordpress:wordpress:5.0:rc3:*:*:*:*:*:*5.0 rc3VulnerableWordPress
  • cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:* Versions before 4.9.9 Vulnerable ·WordPress
  • cpe:2.3:a:wordpress:wordpress:5.0:-:*:*:*:*:*:* Versions 5.0 Vulnerable ·WordPress
  • cpe:2.3:a:wordpress:wordpress:5.0:beta1:*:*:*:*:*:* Versions 5.0 beta1 Vulnerable ·WordPress
  • cpe:2.3:a:wordpress:wordpress:5.0:beta2:*:*:*:*:*:* Versions 5.0 beta2 Vulnerable ·WordPress
  • cpe:2.3:a:wordpress:wordpress:5.0:beta3:*:*:*:*:*:* Versions 5.0 beta3 Vulnerable ·WordPress
  • cpe:2.3:a:wordpress:wordpress:5.0:beta4:*:*:*:*:*:* Versions 5.0 beta4 Vulnerable ·WordPress
  • cpe:2.3:a:wordpress:wordpress:5.0:beta5:*:*:*:*:*:* Versions 5.0 beta5 Vulnerable ·WordPress
  • cpe:2.3:a:wordpress:wordpress:5.0:rc1:*:*:*:*:*:* Versions 5.0 rc1 Vulnerable ·WordPress
  • cpe:2.3:a:wordpress:wordpress:5.0:rc2:*:*:*:*:*:* Versions 5.0 rc2 Vulnerable ·WordPress
  • cpe:2.3:a:wordpress:wordpress:5.0:rc3:*:*:*:*:*:* Versions 5.0 rc3 Vulnerable ·WordPress
Show 1 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-8942
  2. 2026-10-03 Alias added: GHSA-rwhm-6hw4-9fgg

References

Exploit 5

Advisory 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences