CVE-2013-4338

wp-includes/functions.php in WordPress before 3.6.1 does not properly determine whether data has been serialized, which allows remote attackers to execute arbitrary code by triggering erroneous PHP unserialize operations.

CVSS v2.0

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

8.75% chance of exploitation in the next 30 days, 95th percentile

Nuclei

high

Published

2013-09-12

Updated

2024-08-06

Nuclei templates (1)

• topscoder/nuclei-wordfence-cve/blob/main/nuclei-templates/2013/CVE-2013-4338-wordpress-d9…

References

• CVE Record
• NVD entry

Related

• CVE-2013-4322
• CVE-2013-4339
• CVE-2013-4318
• CVE-2013-4340
• CVE-2013-4305
• CVE-2013-4341