CVE-2013-4338

Published: Sep 12, 2013Modified: Apr 29, 2026

7.5

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability: 10.0 / Impact: 6.4

Source: NVD

Description

wp-includes/functions.php in WordPress before 3.6.1 does not properly determine whether data has been serialized, which allows remote attackers to execute arbitrary code by triggering erroneous PHP unserialize operations.

Affected (1)

Products: Wordpress: Wordpress

Wordpress

1 product

Wordpress

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Wordpress Wordpress	Up to 3.6

Related CWEs

CWE-94

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (14)

http://codex.wordpress.org/Version_3.6.1

Source: secalert@redhat.com

Vendor Advisory

http://core.trac.wordpress.org/changeset/25325

Source: secalert@redhat.com

ExploitPatch

http://lists.fedoraproject.org/pipermail/package-announce/2013-September/116828.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2013-September/116832.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2013-September/117118.html

Source: secalert@redhat.com

http://wordpress.org/news/2013/09/wordpress-3-6-1/

Source: secalert@redhat.com

PatchVendor Advisory

http://www.debian.org/security/2013/dsa-2757

Source: secalert@redhat.com

http://codex.wordpress.org/Version_3.6.1