CVE-2017-14719: Before version 4.8.2, WordPress was vulnerable to a directory traversal attack during unzip operations in the ZipArchive and PclZip components.

high Affects WordPress core. Feed 2026.10.29.1, updated 2026-10-28; published 2017-09-23; advisory modified 2026-06-17.

Before version 4.8.2, WordPress was vulnerable to a directory traversal attack during unzip operations in the ZipArchive and PclZip components.

Package: WordPress core WordPress
Affected versions: =3.0 or =3.0.1 or =3.0.2 or =3.0.3 or =3.0.4 or =3.0.5 or =3.0.6 or =3.1 or =3.1.1 or =3.1.2 or =3.1.3 or =3.1.4 or =3.2 or =3.2.1 or =3.3 or =3.3.1 or =3.3.2 or =3.3.3 or =3.4 or =3.4.1 or =3.4.2 or =3.5 or =3.5.1 or =3.5.2 or =3.6 or =3.6.1 or =3.7 or =3.7.1 or =3.7.2 or =3.7.3 or =3.7.4 or =3.7.5 or =3.7.6 or =3.7.7 or =3.7.8 or =3.7.9 or =3.7.10 or =3.7.11 or =3.7.12 or =3.7.13 or =3.7.14 or =3.7.15 or =3.7.16 or =3.7.17 or =3.7.18 or =3.7.19 or =3.7.20 or =3.7.21 or =3.7.22 or =3.8 or =3.8.1 or =3.8.2 or =3.8.3 or =3.8.4 or =3.8.5 or =3.8.6 or =3.8.7 or =3.8.8 or =3.8.9 or =3.8.10 or =3.8.11 or =3.8.12 or =3.8.13 or =3.8.14 or =3.8.15 or =3.8.16 or =3.8.17 or =3.8.18 or =3.8.19 or =3.8.20 or =3.8.21 or =3.8.22 or =3.9 or =3.9.1 or =3.9.2 or =3.9.3 or =3.9.4 or =3.9.5 or =3.9.6 or =3.9.7 or =3.9.8 or =3.9.9 or =3.9.10 or =3.9.11 or =3.9.12 or =3.9.13 or =3.9.14 or =3.9.15 or =3.9.16 or =3.9.17 or =3.9.18 or =3.9.19 or =3.9.20 or =4.0 or =4.0.1 or =4.0.2 or =4.0.3 or =4.0.4 or =4.0.5 or =4.0.6 or =4.0.7 or =4.0.8 or =4.0.9 or =4.0.10 or =4.0.11 or =4.0.12 or =4.0.13 or =4.0.14 or =4.0.15 or =4.0.16 or =4.0.17 or =4.0.18 or =4.0.19 or =4.1 or =4.1.1 or =4.1.2 or =4.1.3 or =4.1.4 or =4.1.5 or =4.1.6 or =4.1.7 or =4.1.8 or =4.1.9 or =4.1.10 or =4.1.11 or =4.1.12 or =4.1.13 or =4.1.14 or =4.1.15 or =4.1.16 or =4.1.17 or =4.1.18 or =4.1.19 or =4.2 or =4.2.1 or =4.2.2 or =4.2.3 or =4.2.4 or =4.2.5 or =4.2.6 or =4.2.7 or =4.2.8 or =4.2.9 or =4.2.10 or =4.2.11 or =4.2.12 or =4.2.13 or =4.2.14 or =4.2.15 or =4.2.16 or =4.3 or =4.3.1 or =4.3.2 or =4.3.3 or =4.3.4 or =4.3.5 or =4.3.6 or =4.3.7 or =4.3.8 or =4.3.9 or =4.3.10 or =4.3.11 or =4.3.12 or =4.4 or =4.4.1 or =4.4.2 or =4.4.3 or =4.4.4 or =4.4.5 or =4.4.6 or =4.4.7 or =4.4.8 or =4.4.9 or =4.4.10 or =4.4.11 or =4.5 or =4.5.1 or =4.5.2 or =4.5.3 or =4.5.4 or =4.5.5 or =4.5.6 or =4.5.7 or =4.5.8 or =4.5.9 or =4.5.10 or =4.6 or =4.6.1 or =4.6.2 or =4.6.3 or =4.6.4 or =4.6.5 or =4.6.6 or =4.6.7 or =4.7 or =4.7.1 or =4.7.2 or =4.7.3 or =4.7.4 or =4.7.5 or =4.8 or =4.8.1
Fixed in: no fix recorded
Severity: high CVSS 7.5
Exploitation: not on CISA KEV · EPSS 12% (96.2th percentile)
Published: 2017-09-23
Source: nvd

References

CWE-22

NVD record WordPress core advisories

Am I affected?

Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# one-time install
pip install phpwarden

# then
phpwarden wordpress /var/www/html

Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.

Install docs How findings are ranked

Related advisories

CVE-2026-63030 KEV critical WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoi same package: WordPress core
CVE-2026-60137 KEV medium WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly same package: WordPress core
CVE-2022-21661 high WordPress is a free and open-source content management system written in PHP and paired wi same package: WordPress core
CVE-2019-8943 medium WordPress through 5.0.3 allows Path Traversal in wp_crop_image(). An attacker (who has pri same package: WordPress core
CVE-2017-5487 medium wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API implemen same package: WordPress core
CVE-2021-29447 high Wordpress is an open source CMS. A user with the ability to upload files (like an Author) same package: WordPress core