CVE-2005-2612

Direct code injection vulnerability in WordPress 1.5.1.3 and earlier allows remote attackers to execute arbitrary PHP code via the cache_lastpostdate[server] cookie.

CVSS v2.0

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

38.77% chance of exploitation in the next 30 days, 98th percentile

Nuclei

high

Published

2005-08-17

Updated

2024-09-17

Nuclei templates (1)

• topscoder/nuclei-wordfence-cve/blob/main/nuclei-templates/2005/CVE-2005-2612-wordpress-fb…

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/wp_lastpost_exec.rb

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/16895

References

• CVE Record
• NVD entry

Related

• CVE-2005-2611
• CVE-2005-2616
• CVE-2005-2603
• CVE-2005-2629
• CVE-2005-2594
• CVE-2005-2633