‹ BackHN Continuity

Thread

WordPress: Unauthenticated path traversal leading to conditional RCE

240 points · 132 comments · vntok

  1. chrismorgan · · focus · HN ↗
    The patch (identified from <a href="https:&#x2F;&#x2F;github.com&#x2F;WordPress&#x2F;wordpress-develop&#x2F;compare&#x2F;7.1.1...7.1.2" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;WordPress&#x2F;wordpress-develop&#x2F;compare&#x2F;7.1.1...):

    <a href="https:&#x2F;&#x2F;github.com&#x2F;WordPress&#x2F;wordpress-develop&#x2F;commit&#x2F;9c4e852f2699104a3bf59d35a3b3f55b2e91ccb6" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;WordPress&#x2F;wordpress-develop&#x2F;commit&#x2F;9c4e85...

    1. bakugo · · focus · HN ↗
      It&#x27;s crazy to me that WP still doesn&#x27;t make use of proper function type declarations, 11 years after they were added to PHP.
      1. paulryanrogers · · focus · HN ↗
        Inertia. The minimum PHP version that WP needs--in practice--is PHP 7.0.
Open on Hacker News to reply ↗

Unofficial Hacker News client; not affiliated with Y Combinator.