Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-wqqa-dsvt-z3fw
Vulnerability ID VCID-wqqa-dsvt-z3fw
Aliases CVE-2005-2612
Summary Direct code injection vulnerability in WordPress 1.5.1.3 and earlier allows remote attackers to execute arbitrary PHP code via the cache_lastpostdate[server] cookie.
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (0)
There are no known CWE.
System Score Found at
epss 0.73416 https://api.first.org/data/v1/epss?cve=CVE-2005-2612
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2005-2612
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2612
323040 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=323040
CVE-2005-2612;OSVDB-18672 Exploit https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/16895.rb
Data source Exploit-DB
Date added July 3, 2010
Description WordPress Core 1.5.1.3 - 'cache_lastpostdate' Arbitrary Code Execution (Metasploit)
Ransomware campaign use Known
Source publication date July 3, 2010
Exploit type webapps
Platform php
Source update date May 4, 2017
Data source Metasploit
Description This module exploits an arbitrary PHP code execution flaw in the WordPress blogging software. This vulnerability is only present when the PHP 'register_globals' option is enabled (common for hosting providers). All versions of WordPress prior to 1.5.1.3 are affected.
Note 
Reliability:
  - unknown-reliability
Stability:
  - unknown-stability
SideEffects:
  - unknown-side-effects
Ransomware campaign use Unknown
Source publication date Aug. 9, 2005
Platform PHP
Source URL https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/unix/webapp/wp_lastpost_exec.rb
There are no known vectors.
Exploit Prediction Scoring System (EPSS)
Percentile 0.98824
EPSS Score 0.73416
Published At May 29, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-05-29T13:40:36.232962+00:00 Debian Oval Importer Import https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 38.6.0