Description

The XML-RPC remote publishing interface in xmlrpc.php in WordPress before 3.0.3 does not properly check capabilities, which allows remote authenticated users to bypass intended access restrictions, and publish, edit, or delete posts, by leveraging the Author or Contributor role.

Remediation

References

CVE-2010-5106

Related Vulnerabilities

IBM RTC Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2021-20357)

WordPress Plugin Slider by 10Web-Responsive Image Slider Unspecified Vulnerability (1.1.9)

WordPress Plugin PHP Speedy 'admin_container.php' Remote PHP Code Execution (0.5.2)

Drupal Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2020-13671)

Jboss EAP Exposure of Resource to Wrong Sphere Vulnerability (CVE-2021-3859)

Severity

Medium

Tags

Missing Update Known Vulnerabilities CWE-264 CVE-2010-5106