‹ BackHN Continuity

Thread

WordPress: Unauthenticated path traversal leading to conditional RCE

240 points · 132 comments · vntok

  1. chrismorgan · · focus · HN ↗
    The patch (identified from <a href="https:&#x2F;&#x2F;github.com&#x2F;WordPress&#x2F;wordpress-develop&#x2F;compare&#x2F;7.1.1...7.1.2" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;WordPress&#x2F;wordpress-develop&#x2F;compare&#x2F;7.1.1...):

    <a href="https:&#x2F;&#x2F;github.com&#x2F;WordPress&#x2F;wordpress-develop&#x2F;commit&#x2F;9c4e852f2699104a3bf59d35a3b3f55b2e91ccb6" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;WordPress&#x2F;wordpress-develop&#x2F;commit&#x2F;9c4e85...

    1. mgkimsal · · focus · HN ↗
      Would have been nice to have a test demonstrating the fix.
Open on Hacker News to reply ↗

Unofficial Hacker News client; not affiliated with Y Combinator.