Description

wp-admin/async-upload.php in the media uploader in WordPress before 3.0.5 allows remote authenticated users to read (1) draft posts or (2) private posts via a modified attachment_id parameter.

Remediation

References

CVE-2011-0701

Related Vulnerabilities

Jenkins Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2021-21611)

TYPO3 Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2010-3673)

WordPress Plugin Advanced Shipping Validation for WooCommerce Cross-Site Scripting (1.0.0)

WordPress Plugin Gutenberg Forms-WordPress Form Builder Arbitrary File Upload (2.2.9)

WordPress Plugin Tidio Gallery Multiple Vulnerabilities (1.1)

Severity

Medium

Tags

Missing Update Known Vulnerabilities CWE-200 CVE-2011-0701