Vulnerability record · CVE-2019-8943 · published 20 February 2019
CVE-2019-8943: WordPress wp_crop_image() path traversal allows arbitrary file write
Wordpress · Wordpress
WordPress through 5.0.3 allows path traversal in wp_crop_image(). A user with privileges to crop an image can supply a filename containing two image extensions and ../ sequences to write the cropped output to an arbitrary directory. Because the write target is attacker-controlled, this can place executable files outside the intended uploads path.
Description
WordPress through 5.0.3 allows Path Traversal in wp_crop_image(). An attacker (who has privileges to crop an image) can write the output image to an arbitrary directory via a filename containing two image extensions and ../ sequences, such as a filename ending with the .jpg?/../../file.jpg substring.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Automated analysis
high priorityThe flaw requires authenticated low privileges but enables arbitrary file write with public exploit code and a documented RCE chain, and EPSS is extremely high despite no KEV listing.
What it is
WordPress through 5.0.3 allows path traversal in wp_crop_image(). A user with privileges to crop an image can supply a filename containing two image extensions and ../ sequences to write the cropped output to an arbitrary directory. Because the write target is attacker-controlled, this can place executable files outside the intended uploads path.
Impact
An attacker with image-cropping privileges gains arbitrary file write, which can be chained to remote code execution by writing a PHP file into a web-accessible location. The CVSS vector rates integrity impact High with no confidentiality or availability impact.
Attack surface
Reached over the network through the WordPress image crop functionality; the CVSS vector requires low privileges (PR:L) and no user interaction (UI:N). The attacker must already hold a role permitted to crop images.
Exploitation
CISA KEV does not list this CVE, but EPSS is very high (0.92642 probability, 0.99822 percentile) and multiple references are tagged Exploit, including public Metasploit and Exploit-DB entries. Public exploit code and a documented RCE chain exist.
What to do
- Upgrade WordPress to a version after 5.0.3 that fixes the wp_crop_image() path traversal.
- If immediate upgrade is not possible, restrict image-cropping capabilities to trusted roles and review which accounts hold upload/edit permissions.
- Disable or restrict PHP execution in the uploads directory and other writable web paths via web server configuration.
- Monitor and restrict write access to web-accessible directories so uploaded or cropped files cannot be executed.
- Apply virtual patching or WAF rules that block filenames containing ../ sequences or double image extensions in crop requests.
Detection
- Review web server and WordPress logs for crop requests containing filenames with ../ sequences or double image extensions such as .jpg?/../../file.jpg.
- Monitor the uploads directory and other writable web paths for unexpected PHP files or files written outside normal upload locations.
- Alert on new executable files appearing in web-accessible directories shortly after image crop activity.
- Hunt for use of known public exploit tooling against wp_crop_image() endpoints in HTTP request logs.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2019-8943 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2019-8943), CISA KEV, FIRST EPSS (scores of 2026-09-24). This page is refreshed as NVD updates the record.
