How to fix WordPress CVE vulnerabilities or preventive measures?

Question

I have a WordPress site running on version 4.9.8. In the recent security audit done by the organization following issues were reported.

1) Wordpress: CVE-2017-1000600: Input Validation vulnerability in thumbnail processing can result in remote code execution.

Versions affected : WordPress version <4.9

2) Wordpress: CVE-2018-1000773: Input Validation vulnerability in thumbnail processing can result in remote code execution.

Versions affected : WordPress version 4.9.8 and earlier

3) Wordpress: CVE-2018-14028: Upload plugin and theme functionalities are not removing uploaded files after failure conditions.

Versions affected : WordPress 4.9.7

Following are my questions.

1) Are points 1 and 2 invalid in my case as I am on 4.9.8 version.

2) Are these issues fixed in the latest update?

Latest WordPress security release is WordPress 5.0.1 Security Release

If issues are not fixed in the latest version. Is there any way or plugin which can help me fix these issues?

Answer 1

So multiple questions here.

1: Are points 1 and 2 invalid in my case as I am on 4.9.8 version.

So Vuln 1 (1000600) is invalid as it does not include 4.9, but everything below that.

Vuln2 1000773 is not invalid and is a finding. How risky it is is dubious though and based on how much access your users have. See the linked reference and below quote:

https://www.theregister.co.uk/2018/08/20/php_unserialisation_wordpress_vuln/

"As things stand, the objective scope of the vulnerability, and how easy it might be to exploit is unclear. Thomas's presentation contained a number of caveats omitted from Secarma's press release about the presentation, which boldly claimed the flaw left "30 per cent of the world's top 1,000 websites vulnerable to hacking and data breaches."

Crucially, an attacker would need a suitable account, be able to upload images or other files, and the site would need a vulnerable plugin installed before malicious commands could be injected, for example. To pull off a complete host system compromise, further vulnerabilities would likely need to be exploited to escalate the intruder's privileges."

2: Are these issues fixed in the latest update?

https://www.cvedetails.com/version/263829/Wordpress-Wordpress-4.9.8.html

Not specified if 5.0.1 has fixed all of these; that said they are not listed on any sites as being found in 5.0.1. And all but one were fixed by 4.9.8.

https://latesthackingnews.com/2018/12/16/seven-wordpress-vulnerabilities-fixed-in-version-5-0-1/

This site references a PHP_uniserialisations_vuln being fixed for 5.0.1 which I imagine has to be this one... but can't say for sure. Eitherway, It's probably worth checking on a dev box if upgrading breaks anything and then pushing it, or verifying your users don't have permissions to allow the vuln to work.