Description

In WordPress before 4.7.5, there is a lack of capability checks for post meta data in the XML-RPC API.

Remediation

References

CVE-2017-9065

Related Vulnerabilities

PHP Improper Input Validation Vulnerability (CVE-2017-8923)

Drupal Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2016-6212)

WordPress Plugin Taxonomy Converter Unspecified Vulnerability (1.1)

WordPress Plugin 123ContactForm for WordPress Multiple Vulnerabilities (1.5.6)

WordPress Plugin Paid Memberships Pro-Restrict Member Access to Content, Courses, Communities-Free or Paid Subscriptions Cross-Site Scripting (2.5.9.1)

Severity

High

Classification

CVE-2017-9065 CWE-20 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Tags

Missing Update Known Vulnerabilities