UnratedFix available
wordpress — security advisory
Unrestricted file upload vulnerability in WordPress 2.5.1 and earlier might allow remote authenticated administrators to upload and execute arbitrary PHP files via the Upload section in the Write Tabs area of the dashboard.
- Products
- wordpress
- Affected versions
- Not specified
- Fixed versions
- 2.5.1-4
- CVEs
- CVE-2008-2392
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 23:13 UTC · Revision 1
Source evidence
Unrestricted file upload vulnerability in WordPress 2.5.1 and earlier might allow remote authenticated administrators to upload and execute arbitrary PHP files via the Upload section in the Write Tabs area of the dashboard.
osv:DEBIAN-CVE-2008-2392
wordpress
Fixed versions: 2.5.1-4
wordpress
Fixed versions: 2.5.1-4
wordpress
Fixed versions: 2.5.1-4
Complete source record
{
"id": "1ada40af791164714c01e5b7e8801aac68bb66510318f57149d0669ad1b50f0f",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2008-2392",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2008-2392",
"summary": "Unrestricted file upload vulnerability in WordPress 2.5.1 and earlier might allow remote authenticated administrators to upload and execute arbitrary PHP files via the Upload section in the Write Tabs area of the dashboard.",
"evidence": "osv:DEBIAN-CVE-2008-2392",
"products": [
{
"name": {
"value": "wordpress",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.5.1-4",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "wordpress",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.5.1-4",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "wordpress",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.5.1-4",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "DEBIAN-CVE-2008-2392",
"aliases": [
"DEBIAN-CVE-2008-2392"
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.5.1-4"
}
]
}
],
"package": {
"name": "wordpress",
"purl": "pkg:deb/debian/wordpress?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2008-2392.json"
},
"ecosystem_specific": {
"urgency": "low"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.5.1-4"
}
]
}
],
"package": {
"name": "wordpress",
"purl": "pkg:deb/debian/wordpress?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2008-2392.json"
},
"ecosystem_specific": {
"urgency": "low"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.5.1-4"
}
]
}
],
"package": {
"name": "wordpress",
"purl": "pkg:deb/debian/wordpress?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2008-2392.json"
},
"ecosystem_specific": {
"urgency": "low"
}
}
],
"modified": "2026-10-23T17:47:37.887478573Z",
"provider": "osv",
"upstream": [
"CVE-2008-2392"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2008-2392"
]
},
"related_cves": [
{
"value": "CVE-2008-2392",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 418031,
"published_at": "2008-05-21T13:24:00+00:00"
}