Description
wp-includes/capabilities.php in WordPress before 3.0.2, when a Multisite configuration is used, does not require the Super Admin role for the delete_users capability, which allows remote authenticated administrators to bypass intended access restrictions via a delete action.
Remediation
References
Related Vulnerabilities
WordPress Plugin Bulk Delete Users by Email Cross-Site Request Forgery (1.0)
Oracle Database Server CVE-2013-1534 Vulnerability (CVE-2013-1534)
WordPress Other Vulnerability (CVE-2007-4154)
WebLogic CVE-2020-14757 Vulnerability (CVE-2020-14757)
Jenkins Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2015-5321)