Description
php-wrapper.fcgi does not properly handle command-line arguments, which allows remote attackers to bypass a protection mechanism in PHP 5.3.12 and 5.4.2 and execute arbitrary code by leveraging improper interaction between the PHP sapi/cgi/cgi_main.c component and a query string beginning with a +- sequence.
Remediation
References
Related Vulnerabilities
WordPress Plugin WP Review Slider SQL Injection (12.1)
WordPress 3.8.x Multiple Vulnerabilities (3.8 - 3.8.25)
WordPress Plugin Event Registration 'id' Parameter SQL Injection (5.43)
WordPress Plugin WP Marketplace TimThumb Arbitrary File Upload (1.1.0)
Drupal Core 8.x Multiple Security Bypass Vulnerabilities (8.0.0 - 8.3.6)