Vulnerability record · CVE-2019-8942 · published 20 February 2019
CVE-2019-8942: WordPress Author-Privilege Image Upload Remote Code Execution
Wordpress · Wordpress
WordPress before 4.9.9 and 5.x before 5.0.1 allows an authenticated author to change the _wp_attached_file Post Meta entry to an arbitrary string and upload a crafted image containing PHP code in Exif metadata, resulting in remote code execution. The flaw is an unrestricted file upload (CWE-434) that can be chained with CVE-2019-8943. It matters because a low-privileged content role can turn a normal media upload into server-side code execution.
Description
WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an _wp_attached_file Post Meta entry can be changed to an arbitrary string, such as one ending with a .jpg?file.php substring. An attacker with author privileges can execute arbitrary code by uploading a crafted image containing PHP code in the Exif metadata. Exploitation can leverage CVE-2019-8943.
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Automated analysis
high priorityA low-privileged authenticated author can achieve remote code execution, public exploit code exists, and EPSS is very high, though it is not in CISA KEV.
What it is
WordPress before 4.9.9 and 5.x before 5.0.1 allows an authenticated author to change the _wp_attached_file Post Meta entry to an arbitrary string and upload a crafted image containing PHP code in Exif metadata, resulting in remote code execution. The flaw is an unrestricted file upload (CWE-434) that can be chained with CVE-2019-8943. It matters because a low-privileged content role can turn a normal media upload into server-side code execution.
Impact
An attacker with author privileges gains arbitrary code execution on the WordPress host, leading to full compromise of the site and potentially the underlying server. CVSS 3.0 scores it 8.8 (HIGH) with confidentiality, integrity and availability all rated High.
Attack surface
Reached over the network via the WordPress media/upload functionality; the CVSS vector AV:N/AC:L/PR:L/UI:N indicates no user interaction is required but a low-privileged authenticated account (author) is needed. The description confirms the attacker must have author privileges.
Exploitation
CISA KEV does not list this CVE, but EPSS is very high (0.82736 probability, 0.99652 percentile) and multiple references are tagged Exploit, including Packet Storm, Rapid7, Exploit-DB and a vendor analysis, indicating public exploit code exists.
What to do
- Upgrade WordPress to 4.9.9 or 5.0.1 or later; Debian users should apply DSA-4401.
- Restrict author-level accounts and review who holds upload/media privileges.
- Disable or constrain PHP execution in the WordPress uploads directory via web server configuration.
- Validate and sanitize image metadata handling, and monitor for unexpected changes to _wp_attached_file post meta.
- Apply the CVE-2019-8943 fix as well, since exploitation can leverage it.
Detection
- Monitor for modifications to _wp_attached_file post meta values that contain unexpected substrings such as .jpg?file.php.
- Alert on PHP files or PHP code appearing under wp-content/uploads.
- Review web server logs for requests to uploaded image paths that execute PHP.
- Audit author-role accounts for unusual media upload activity.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2019-8942 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2019-8942), CISA KEV, FIRST EPSS (scores of 2026-09-24). This page is refreshed as NVD updates the record.
