Description
A weakness has been discovered in WordPress, which can be exploited by malicious people to bypass certain security restrictions. The weakness is caused due to the fact that it is possible to construct the two authentication cookies ("wordpressuser_*" and "wordpresspass_*") from the data in the "users" table. Successful exploitation allows e.g. logging in as administrator, but requires read access to the "users" table of the database. The weakness is confirmed in version 2.3.1 and reported in all previous versions down to and including 1.5.
Remediation
Update to WordPress version 2.5 or latest
References
http://www.securityfocus.com/archive/1/483927
http://core.trac.wordpress.org/ticket/5367
http://packetstormsecurity.org/files/view/61150/wordpress-cookie-auth.txt
Related Vulnerabilities
WordPress Plugin Front-End Only Users Cross-Site Scripting (3.1.10)
WordPress Plugin Thrive Clever Widgets Security Bypass (1.56)
WordPress Plugin Popup box SQL Injection (2.3.3)
WordPress Plugin GS Filterable Portfolio Cross-Site Scripting (1.6.0)
Drupal Improper Input Validation Vulnerability (CVE-2022-25271)