Path traversal vulnerability in the upgrade package uploader

A user that has access to the upgrader module can use a specially crafted filename to upload a file in different location.

This vulnerability affects the following application versions:

• WordPress 3.3
• WordPress 3.3.1
• WordPress 3.3.2
• WordPress 3.3.3
• WordPress 3.4
• WordPress 3.4.1
• WordPress 3.4.2
• WordPress 3.5
• WordPress 3.5.1
• WordPress 3.5.2
• WordPress 3.6
• WordPress 3.6.1
• WordPress 3.7
• WordPress 3.7.1
• WordPress 3.7.2
• WordPress 3.7.3
• WordPress 3.7.4
• WordPress 3.7.5
• WordPress 3.7.6
• WordPress 3.7.7
• WordPress 3.7.8
• WordPress 3.7.9
• WordPress 3.7.10
• WordPress 3.7.11
• WordPress 3.7.12
• WordPress 3.7.13
• WordPress 3.7.14
• WordPress 3.7.15
• WordPress 3.8
• WordPress 3.8.1
• WordPress 3.8.2
• WordPress 3.8.3
• WordPress 3.8.4
• WordPress 3.8.5
• WordPress 3.8.6
• WordPress 3.8.7
• WordPress 3.8.8
• WordPress 3.8.9
• WordPress 3.8.10
• WordPress 3.8.11
• WordPress 3.8.12
• WordPress 3.8.13
• WordPress 3.8.14
• WordPress 3.8.15
• WordPress 3.9
• WordPress 3.9.1
• WordPress 3.9.2
• WordPress 3.9.3
• WordPress 3.9.4
• WordPress 3.9.5
• WordPress 3.9.6
• WordPress 3.9.7
• WordPress 3.9.8
• WordPress 3.9.9
• WordPress 3.9.10
• WordPress 3.9.11
• WordPress 3.9.12
• WordPress 3.9.13
• WordPress 4.0
• WordPress 4.0.1
• WordPress 4.0.2
• WordPress 4.0.3
• WordPress 4.0.4
• WordPress 4.0.5
• WordPress 4.0.6
• WordPress 4.0.7
• WordPress 4.0.8
• WordPress 4.0.9
• WordPress 4.0.10
• WordPress 4.0.11
• WordPress 4.0.12
• WordPress 4.1
• WordPress 4.1.1
• WordPress 4.1.2
• WordPress 4.1.3
• WordPress 4.1.4
• WordPress 4.1.5
• WordPress 4.1.6
• WordPress 4.1.7
• WordPress 4.1.8
• WordPress 4.1.9
• WordPress 4.1.10
• WordPress 4.1.11
• WordPress 4.1.12
• WordPress 4.2
• WordPress 4.2.1
• WordPress 4.2.2
• WordPress 4.2.3
• WordPress 4.2.4
• WordPress 4.2.5
• WordPress 4.2.6
• WordPress 4.2.7
• WordPress 4.2.8
• WordPress 4.2.9
• WordPress 4.3
• WordPress 4.3.1
• WordPress 4.3.2
• WordPress 4.3.3
• WordPress 4.3.4
• WordPress 4.3.5
• WordPress 4.4
• WordPress 4.4.1
• WordPress 4.4.2
• WordPress 4.4.3
• WordPress 4.4.4
• WordPress 4.5
• WordPress 4.5.1
• WordPress 4.5.2
• WordPress 4.5.3
• WordPress 4.6