CVE-2007-1277

no score yetEPSS 28%

WordPress 2.1.1, as downloaded from some official distribution sites during February and March 2007, contains an externally introduced backdoor that allows remote attackers to execute arbitrary commands via (1) an eval injection vulnerability in the ix parameter to wp-includes/feed.php, and (2) an untrusted passthru call in the iz parameter to wp-includes/theme.php.

EPSS: 28% chance of exploitation in the next 30 days; higher than 98% of CVEs (scores of 2026-10-31)
CWE: CWE-20
Published: 2007-03-05
Modified: 2026-06-16
Record from: the NVD, synced 2026-10-19

Affected

wordpress:wordpress

References

http://ifsec.blogspot.com/2007/03/wordpress-code-compromised-to-enable.html
http://secunia.com/advisories/24374
http://wordpress.org/development/2007/03/upgrade-212/
http://www.kb.cert.org/vuls/id/214480
http://www.kb.cert.org/vuls/id/641456

Check your stack JSON