Description

WordPress is a prone to multiple eavesdropping vulnerabilities. Successfully exploiting these issues will allow attackers to obtain sensitive information and possibly to impersonate users and tamper with network data. WordPress versions prior to 2.6.1 are vulnerable.

Remediation

Update to WordPress version 2.6.1 or latest

References

http://core.trac.wordpress.org/ticket/7359

Related Vulnerabilities

WordPress Plugin Yasr-Yet Another Stars Rating SQL Injection (0.9.0)

WordPress Plugin Responsive Clients Logo Gallery for WordPress-Smart Logo Showcase Lite includes Backdoor [Only if downloaded via the vendor website] (1.1.7)

Squid Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2019-12528)

MySQL CVE-2021-35597 Vulnerability (CVE-2021-35597)

Ruby on Rails Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2012-1099)

Severity

High

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Tags

Missing Update CWE-264 CVE-2008-3747