LiveActive security incident?Get immediate response
CVE Record

CVE-2009-3890: Unrestricted file upload vulnerability in the wp_check_filetype function in wp-includes/functions.php in Wo...

Unrestricted file upload vulnerability in the wp_check_filetype function in wp-includes/functions.php in WordPress before 2.8.6, when a certain configuration of the mod_mime module in the Apache HTTP Server is enabled, allows remote authenticated users to execute arbitrary code by posting an attachment with a multiple-extension filename, and then accessing this attachment via a direct request to a wp-content/uploads/ pathname, as demonstrated by a .php.jpg filename.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's Takehigh

Analyst readout for executives and security teams

Plain-English summary

This issue affects WordPress versions before 2.8.6. An authenticated user who can upload attachments could upload a file with a misleading multiple-extension name and, under a specific Apache mod_mime configuration, have it execute as code. This could turn a lower-privileged WordPress account into server compromise.

Executive priority

Prioritize remediation if any public or internal site still runs WordPress before 2.8.6. Although old, successful exploitation can lead to arbitrary code execution on the web server. Modern WordPress deployments should be unaffected if properly updated.

Technical view

CVE-2009-3890 is an unrestricted file upload flaw in wp_check_filetype in wp-includes/functions.php. In WordPress before 2.8.6, with certain Apache mod_mime behavior enabled, multiple-extension filenames such as PHP disguised as an image could be accepted and later executed from wp-content/uploads via direct access.

Likely exposure

Exposure is mainly legacy WordPress installations older than 2.8.6, especially sites allowing authenticated users to post attachments. Risk depends on the Apache mod_mime configuration and whether uploaded files under wp-content/uploads can be executed.

Exploitation context

Public discussion and disclosure existed in November 2009, including Full Disclosure and oss-security references. The provided sources do not show CISA KEV listing or current active exploitation evidence. The attack requires authenticated upload capability and a vulnerable server configuration.

Researcher notes

The CVE record lists no CVSS or CWE data and the affected product fields are sparse, but the description and WordPress release reference identify WordPress before 2.8.6. Configuration dependency is important: not every installation would execute the uploaded file.

Mitigation direction

  • Upgrade WordPress to 2.8.6 or later per the WordPress security release.
  • Review vendor guidance for affected legacy WordPress deployments.
  • Check Apache mod_mime behavior where legacy WordPress uploads are served.
  • Restrict attachment upload privileges until affected systems are remediated.
  • Ensure uploads directories are not configured to execute server-side code.

Validation and detection

  • Inventory WordPress installations and identify versions before 2.8.6.
  • Confirm whether authenticated users can upload attachments.
  • Review Apache configuration for mod_mime handling of multiple extensions.
  • Inspect uploads paths for suspicious multiple-extension files.
  • Confirm remediation by verifying WordPress version 2.8.6 or later.
Prepared
Confidence
medium
Sources
7

Public sources used

Based on public source material and reviewed before publication.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

description · low confidence lookup

Execution behavior lookup

The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
description · low confidence lookup

File access behavior lookup

The CVE wording references file access or upload behavior, so file telemetry and web shell review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2009-3890 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
11Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.