CVE-2013-4338

wp-includes/functions.php in WordPress before 3.6.1 does not properly determine whether data has been serialized, which allows remote attackers to execute arbitrary code by triggering erroneous PHP unserialize operations.

Score

CVSS 2.0 7.5 High

Status

Modified - secalert@redhat.com

Published

2013-09-12

Last modified

2024-08-06

Weaknesses

CWE-94

Affected products

• Wordpress (Wordpress)

References

• http://codex.wordpress.org/Version_3.6.1
• http://core.trac.wordpress.org/changeset/25325
• http://lists.fedoraproject.org/pipermail/package-announce/2013-September/116828.html
• http://lists.fedoraproject.org/pipermail/package-announce/2013-September/116832.html
• http://lists.fedoraproject.org/pipermail/package-announce/2013-September/117118.html
• http://wordpress.org/news/2013/09/wordpress-3-6-1/
• http://www.debian.org/security/2013/dsa-2757