Debian 8 DLA-1742-1 Critical: WordPress Code Execution Issues

CVE-2019-8942

remote code execution in wordpress because an _wp_attached_file Post
Meta entry can be changed to an arbitrary string, such as one ending
with a .jpg?file.php substring. An attacker with author privileges
can execute arbitrary code by uploading a crafted image containing
PHP code in the Exif metadata.

CVE-2019-9787

wordpress does not properly filter comment content, leading to
Remote Code Execution by unauthenticated users in a default
configuration. This occurs because CSRF protection is mishandled,
and because Search Engine Optimization of A elements is performed
incorrectly, leading to XSS. The XSS results in administrative
access.

For Debian 8 "Jessie", these problems have been fixed in version
4.1.26+dfsg-1+deb8u1.

We recommend that you upgrade your wordpress packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS