‹ BackHN Continuity

Thread

WordPress: Unauthenticated path traversal leading to conditional RCE

240 points · 132 comments · vntok

  1. whycome · · focus · HN ↗
    hmm, this may be why i just saw an unexpected update to a very old theme.
    1. patrickdavey · · focus · HN ↗
      It's not clear to me: do we need to both apply the patch _and_ check if our themes are vulnerable, or just apply the patch?

      Edit: looking at the patch itself it looks like it fixes the root cause and so it shouldn't matter what themes are doing themselves. But possibly I'm reading it incorrectly.

Open on Hacker News to reply ↗

Unofficial Hacker News client; not affiliated with Y Combinator.