Description

Before version 4.8.2, WordPress allowed a Directory Traversal attack in the Customizer component via a crafted theme filename.

Remediation

References

CVE-2017-14722

Related Vulnerabilities

WordPress Plugin AdPlugg WordPress Ad Cross-Site Scripting (1.1.33)

Moodle Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2016-2157)

WordPress Weak Password Recovery Mechanism for Forgotten Password Vulnerability (CVE-2014-6412)

Oracle Database Server CVE-2024-20995 Vulnerability (CVE-2024-20995)

Magento Server-Side Request Forgery (SSRF) Vulnerability (CVE-2019-7923)

Severity

High

Classification

CVE-2017-14722 CWE-22 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Missing Update Known Vulnerabilities