Description

WordPress is prone to an unauthorized access vulnerability. Successfully exploiting this issue will allow attackers to reset the password of arbitrary accounts. WordPress 2.6.1 is vulnerable; prior versions may also be affected.

Remediation

Update to WordPress version 2.6.2 or latest

References

http://www.suspekt.org/2008/08/18/mysql-and-sql-column-truncation-vulnerabilities/

http://www.exploit-db.com/exploits/6397/

http://www.exploit-db.com/exploits/6421/

http://packetstormsecurity.org/files/view/69821/wordpress261-admin.txt

Related Vulnerabilities

SugarCRM Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2023-46815)

WordPress Plugin WP-Members Membership Cross-Site Scripting (3.1.4.2)

WordPress Plugin Easy Property Listings Cross-Site Request Forgery (3.3.5.8)

WordPress Plugin WP Customer Reviews Unspecified Vulnerability (3.0.7)

MySQL CVE-2019-2797 Vulnerability (CVE-2019-2797)

Severity

High

Classification

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Tags

Missing Update CWE-20 CVE-2008-4106 CVE-2008-4107