CVE-2007-1277
WordPress 2.1.1, as downloaded from some official distribution sites during February and March...
WordPress 2.1.1, as downloaded from some official distribution sites during February and March 2007, contains an externally introduced backdoor that allows remote attackers to execute arbitrary commands via (1) an eval injection vulnerability in the ix parameter to wp-includes/feed.php, and (2) an untrusted passthru call in the iz parameter to wp-includes/theme.php.
Exploit likelihood
What each source reports
NVD Score used
WordPress 2.1.1, as downloaded from some official distribution sites during February and March 2007, contains an externally introduced backdoor that allows remote attackers to execute arbitrary commands via (1) an eval injection vulnerability in the ix parameter to wp-includes/feed.php, and (2) an untrusted passthru call in the iz parameter to wp-includes/theme.php.
- Record
CVE-2007-1277- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
WordPress 2.1.1, as downloaded from some official distribution sites during February and March 2007, contains an externally introduced backdoor that allows remote attackers to execute arbitrary commands via (1) an eval injection vulnerability in the ix parameter to wp-includes/feed.php, and (2) an untrusted passthru call in the iz parameter to wp-includes/theme.php.
- Record
CVE-2007-1277- Updated
- 2026-11-02
EUVDEUVD-2007-1274 No score
WordPress 2.1.1, as downloaded from some official distribution sites during February and March 2007, contains an externally introduced backdoor that allows remote attackers to execute arbitrary commands via (1) an eval injection vulnerability in the ix parameter to wp-includes/feed.php, and (2) an untrusted passthru call in the iz parameter to wp-includes/theme.php.
- Record
EUVD-2007-1274- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-vp78-84m4-9r4q No score
WordPress 2.1.1, as downloaded from some official distribution sites during February and March...
WordPress 2.1.1, as downloaded from some official distribution sites during February and March 2007, contains an externally introduced backdoor that allows remote attackers to execute arbitrary commands via (1) an eval injection vulnerability in the ix parameter to wp-includes/feed.php, and (2) an untrusted passthru call in the iz parameter to wp-includes/theme.php.
- Record
GHSA-vp78-84m4-9r4q- Weakness
- CWE-20
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | WordPress Core 2.1.1 - Arbitrary Command Execution | 2007-03-02 |
| Exploit-DB | WordPress Core 2.1.1 - '/wp-includes/theme.php?iz' Arbitrary Command Execution | 2007-03-02 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2007-1277 is a high vulnerability (CVSS 7.5) in Wordpress, published March 5, 2007. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 27.8%, the 98th percentile. No source names a fixed version.
