CVE-2008-2392
Unrestricted file upload vulnerability in WordPress 2.5.1 and earlier might allow remote...
Unrestricted file upload vulnerability in WordPress 2.5.1 and earlier might allow remote authenticated administrators to upload and execute arbitrary PHP files via the Upload section in the Write Tabs area of the dashboard.
Exploit likelihood
What each source reports
NVD Score used
Unrestricted file upload vulnerability in WordPress 2.5.1 and earlier might allow remote authenticated administrators to upload and execute arbitrary PHP files via the Upload section in the Write Tabs area of the dashboard.
- Record
CVE-2008-2392- CVSS 2.0
- 9.0 High
AV:N/AC:L/Au:S/C:C/I:C/A:C - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
Unrestricted file upload vulnerability in WordPress 2.5.1 and earlier might allow remote authenticated administrators to upload and execute arbitrary PHP files via the Upload section in the Write Tabs area of the dashboard.
- Record
CVE-2008-2392- Updated
- 2026-11-02
EUVDEUVD-2008-2387 No score
Unrestricted file upload vulnerability in WordPress 2.5.1 and earlier might allow remote authenticated administrators to upload and execute arbitrary PHP files via the Upload section in the Write Tabs area of the dashboard.
- Record
EUVD-2008-2387- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-g734-67mf-ffrp No score
Unrestricted file upload vulnerability in WordPress 2.5.1 and earlier might allow remote...
Unrestricted file upload vulnerability in WordPress 2.5.1 and earlier might allow remote authenticated administrators to upload and execute arbitrary PHP files via the Upload section in the Write Tabs area of the dashboard.
- Record
GHSA-g734-67mf-ffrp- Weakness
- CWE-20
- Updated
- 2026-11-02
OSV No score
Unrestricted file upload vulnerability in WordPress 2.5.1 and earlier might allow remote authenticated administrators to upload and execute arbitrary PHP files via the Upload section in the Write Tabs area of the dashboard.
- Record
CVE-2008-2392- Updated
- 2026-11-02
OSVDEBIAN-CVE-2008-2392 No score
Unrestricted file upload vulnerability in WordPress 2.5.1 and earlier might allow remote authenticated administrators to upload and execute arbitrary PHP files via the Upload section in the Write Tabs area of the dashboard.
- Record
DEBIAN-CVE-2008-2392- Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2008-2392 is a high vulnerability (CVSS 9.0) in Wordpress, published May 21, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.28%, the 91st percentile. Fixed in wordpress 2.5.1-4.