WordPress: Unauthenticated path traversal leading to conditional RCE

Re:WordPress: Unauthenticated path traversal leading to cond... by nicce on Tuesday September 22, 2026 @03:39PM (#49806992)

> We don't need a metric; I'm already going to have to read and assess the vulnerability to decide how I actually want to assess the risk given my infrastructure, so the number's not doing me any good.

Would you say that vulnerability with CVSS score that points to low is equally important to verify and take care of than CVSS which points to critical?

[ Parent | on HN ]

Re:WordPress: Unauthenticated path traversal leading to cond... by akerl_ on Tuesday September 22, 2026 @03:50PM (#49807129)

Yes. I believe that using CVSS scores as a first pass to decide which vulnerabilities to review is risky.

The most boring reason, even if you take CVSS scores at face value, is that in many cases it is possible to leverage multiple "low" severity vulnerabilities into a massive impact.

But the bigger reason is that CVSS scores are all over the place, and the people operating roulette wheel that generates them do not have any insight into any specific person's systems.

[ Parent | on HN ]