Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
🛡️
Not in CISA KEV
MEDIUM severity

CVE-2019-8943 — wordpress

MEDIUM

CVE-2019-8943 is a medium-severity (CVSS 6.5) Path Traversal vulnerability. 13 public exploit references exist, so weaponization risk is real. No vendor fix is recorded yet; mitigation options are listed below.

Published
Updated
Affected
1 product
Patched
See advisory
Exploits
13 known
Exploitation data as of Oct 22, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

EPSS Exploitation Probability

via FIRST.org ↗
92.0%probability of exploitation in next 30 days
Very High Risk-0.66%
Lower risk than most CVEs100th percentile — riskier than 100% of all scored CVEsHighest risk
91.5%92.4%93.3%94.3%93.7%92.6%92.0%Jun 26Sep 26Oct 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

CVE-2019-8943 by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.

Where this sits among everything scored

Of 394,415 CVEs with a current EPSS score, this one falls in the ≥ 90% band (highlighted). Counts from FIRST.org, log-scaled.

Description

WordPress through 5.0.3 allows Path Traversal in wp_crop_image(). An attacker (who has privileges to crop an image) can write the output image to an arbitrary directory via a filename containing two image extensions and ../ sequences, such as a filename ending with the .jpg?/../../file.jpg substring.

Affected Products

1 product · 1 configurations
Application
wordpresswordpress
≤ 5.0.3
range
Exploits & PoCs
13

Research use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.

EDB-46511webappsphp

WordPress Core 5.0 - Remote Code Execution

by allyshka · Mar 1, 2019

Exploit-DB Source
EDB-46662remotephp✓ Verified

WordPress Core 5.0.0 - Crop-image Shell Upload (Metasploit)

by Metasploit · Apr 5, 2019

Exploit-DB Source

Detection & mitigation playbook

Vulnerability

  1. Detect

    Identify every host running the affected component and compare the installed build against the fixed version below — for source-built or distro-packaged software the version string, not a lockfile, is the source of truth (`dpkg -l`, `rpm -q`, or the binary's own `--version`).

  2. Remediation status

    No fixed release is recorded for CVE-2019-8943 yet. Track the upstream advisory, and apply the exposure-reduction steps below in the meantime.

  3. Mitigate without a patch

    Resolve every user-supplied path to its canonical form and reject anything that escapes the intended directory, and run the component under an account that has no read or write access outside the directory it legitimately serves.

How to detect CVE-2019-8943

A community-maintained Nuclei template exists for this CVE. You can scan for it directly:

nuclei -id cve-2019-8943 -u https://target
Template
WordPress Core 5.0.0 - Crop-image Shell Upload
Severity
medium
Impact
Authenticated attackers with image cropping privileges can write output images to arbitrary directories via path traversal, potentially overwriting critical system files or placing web shells in accessible locations.
Remediation
Upgrade to WordPress version 5.0.4 or later.

Template by ProjectDiscovery nuclei-templates (sttlr), MIT licensed. View the full template. Scan only systems you are authorised to test.

Frequently Asked Questions

WordPress through 5.0.3 allows Path Traversal in wp_crop_image(). An attacker (who has privileges to crop an image) can write the output image to an arbitrary directory via a filename containing two image extensions and ../ sequences, such as a filename ending with the .jpg?/../../file.jpg substring.
O3 Security · Impact-Aware SCA

Is CVE-2019-8943 in your dependencies?

Find it across , including transitive dependencies.

Scan my dependencies How O3 SCA works
CVE-2019-8943: wordpress Path Traversal (Medium 6.5)