Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-xj9y-sb3e-vkac
Vulnerability ID VCID-xj9y-sb3e-vkac
Aliases CVE-2007-0540
Summary WordPress allows remote attackers to cause a denial of service (bandwidth or thread consumption) via pingback service calls with a source URI that corresponds to a file with a binary content type, which is downloaded even though it cannot contain usable pingback data.
Status Published
Exploitability 2.0
Weighted Severity 4.5
Risk 9.0
Affected and Fixed Packages Package Details
Weaknesses (0)
There are no known CWE.
System Score Found at
epss 0.0776 https://api.first.org/data/v1/epss?cve=CVE-2007-0540
epss 0.0776 https://api.first.org/data/v1/epss?cve=CVE-2007-0540
epss 0.0776 https://api.first.org/data/v1/epss?cve=CVE-2007-0540
epss 0.0776 https://api.first.org/data/v1/epss?cve=CVE-2007-0540
epss 0.0776 https://api.first.org/data/v1/epss?cve=CVE-2007-0540
epss 0.0776 https://api.first.org/data/v1/epss?cve=CVE-2007-0540
epss 0.0776 https://api.first.org/data/v1/epss?cve=CVE-2007-0540
epss 0.0776 https://api.first.org/data/v1/epss?cve=CVE-2007-0540
epss 0.0776 https://api.first.org/data/v1/epss?cve=CVE-2007-0540
cvssv2 5.0 https://nvd.nist.gov/vuln/detail/CVE-2007-0540
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2007-0540
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0540
http://secunia.com/advisories/30013
http://securityreason.com/securityalert/2191
http://www.debian.org/security/2008/dsa-1564
http://www.securityfocus.com/archive/1/457996/100/0/threaded
http://www.securityfocus.com/archive/1/458003/100/0/threaded
cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*
CVE-2007-0540 https://nvd.nist.gov/vuln/detail/CVE-2007-0540
CVE-2007-0540;OSVDB-33006 Exploit https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/29522.py
CVE-2007-0540;OSVDB-33006 Exploit https://www.securityfocus.com/bid/22220/info
Data source Exploit-DB
Date added Jan. 24, 2007
Description WordPress Core 1.x/2.0.x - Pingback SourceURI Denial of Service / Information Disclosure
Ransomware campaign use Known
Source publication date Jan. 24, 2007
Exploit type webapps
Platform php
Source update date Nov. 8, 2013
Source URL https://www.securityfocus.com/bid/22220/info
Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P Found at https://nvd.nist.gov/vuln/detail/CVE-2007-0540
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Exploit Prediction Scoring System (EPSS)
Percentile 0.91909
EPSS Score 0.0776
Published At April 1, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T16:30:16.746596+00:00 Debian Oval Importer Import https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 38.0.0