WordPress Vulnerabilities

WordPress 4.3-4.7 - Remote Code Execution (RCE) in PHPMailer

Affects WordPress

4.3

Fixed in version 4.3.7

4.3.1

Fixed in version 4.3.7

4.4

Fixed in version 4.4.6

4.3.2

Fixed in version 4.3.7

4.4.1

Fixed in version 4.4.6

4.4.2

Fixed in version 4.4.6

4.3.3

Fixed in version 4.3.7

4.5

Fixed in version 4.7.1

4.5.1

Fixed in version 4.5.5

4.3.4

Fixed in version 4.3.7

References

URL

https://www.wordfence.com/blog/2016/12/phpmailer-vulnerability/

URL

https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilities

URL

https://wordpress.org/news/2017/01/wordpress-4-7-1-security-and-maintenance-release/

URL

https://github.com/WordPress/WordPress/commit/24767c76d359231642b0ab48437b64e8c6c7f491

URL

http://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html

Metasploit

exploit/unix/webapp/wp_phpmailer_host_header

Classification

Type

RCE

OWASP top 10

A1: Injection

CWE

CWE-94

Miscellaneous

Submitter

ethicalhack3r

Submitter twitter

ethicalhack3r

Verified

WPVDB ID

146d60de-b03c-48c6-9b8b-344100f5c3d6

Timeline

Publicly Published

2017-01-11 (about 6 years ago)

Added

2017-01-12 (about 6 years ago)

Last Updated

2019-11-01 (about 3 years ago)

Our Other Services

WPScan WordPress Security Plugin