High severity8.8OSV Advisory· Published Sep 6, 2018· Updated Jun 17, 2026

CVE-2017-1000600

Description

WordPress version <4.9 contains a CWE-20 Input Validation vulnerability in thumbnail processing that can result in remote code execution. This attack appears to be exploitable via thumbnail upload by an authenticated user and may require additional plugins in order to be exploited however this has not been confirmed at this time. This issue appears to have been partially, but not completely fixed in WordPress 4.9

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/WordPressOSV2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: <4.9
Package: https://wordpress.org/plugins/wordpress

Patches

Vulnerability mechanics

References

www.securityfocus.com/bid/105305nvdThird Party AdvisoryVDB Entry
www.theregister.co.uk/2018/08/20/php_unserialisation_wordpress_vuln/nvdThird Party Advisory
youtu.be/GePBmsNJw6YnvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.572
epss	0.003
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000