WordPress Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2011-3818)

Description

WordPress 2.9.2 and 3.0.4 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by wp-admin/includes/user.php and certain other files.

Remediation

References

CVE-2011-3818

Related Vulnerabilities

Apache HTTP Server Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2017-7679)

WebLogic Deserialization of Untrusted Data Vulnerability (CVE-2020-9547)

WordPress Plugin MailPoet Newsletters (Previous) Cross-Site Scripting (2.6.19)

WordPress Plugin Download Manager PHAR Deserialization (3.2.49)

WordPress Plugin Simple Slideshow Manager Multiple Unspecified Vulnerabilities (2.1)

Severity

Medium

Classification

CVE-2011-3818 CWE-200