Description
WordPress is prone to multiple vulnerabilities, including deserialization and PHP file upload vulnerabilities. Exploiting these issues could allow an attacker to call arbitrary PHP Objects that can be used to perform a variety of malicious actions, granted a POP chain is also present or to upload arbitrary code and run it in the context of the webserver process, which may facilitate unauthorized access or privilege escalation. WordPress versions 6.1.x ranging from 6.1 and up to (and including) 6.1.4 are vulnerable.
Remediation
Update to WordPress version 6.1.5 or latest
References
Related Vulnerabilities
Plone CMS Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2012-5493)
MySQL CVE-2014-2436 Vulnerability (CVE-2014-2436)
WordPress Plugin WP Geoloc Cross-Site Scripting (1.0.0)
Oracle JRE CVE-2013-1480 Vulnerability (CVE-2013-1480)
ownCloud Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2016-1501)