Description
WordPress is prone to a vulnerability which can be exploited by malicious people to cause a Denial of Service. The vulnerability is caused due to the 'wp-trackback.php' script letting users pass multiple source character encodings to the "mb_convert_encoding()" function, which can be used to cause a high CPU load, potentially resulting in a DoS, thus denying service to legitimate users. WordPress versions prior to 2.8.5 are vulnerable.
Remediation
Update to WordPress version 2.8.5 or latest
References
http://rooibo.wordpress.com/2009/10/17/agujero-de-seguridad-en-wordpress/
http://wordpress.org/news/2009/10/wordpress-2-8-5-hardening-release/
Related Vulnerabilities
TYPO3 Incorrect Authorization Vulnerability (CVE-2024-47780)
TYPO3 Insertion of Sensitive Information into Log File Vulnerability (CVE-2024-55891)
Liferay DXP Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2025-43809)
WordPress Plugin EmbedSocial-Social Media Feeds, Reviews and Galleries Cross-Site Scripting (1.1.27)
WordPress Plugin Calendar Multiple Cross-Site Scripting Vulnerabilities (1.2.1)