Description
The create_post function in wp-includes/class-wp-atom-server.php in WordPress before 3.4.2 does not perform a capability check, which allows remote authenticated users to bypass intended access restrictions and publish new posts by leveraging the Contributor role and using the Atom Publishing Protocol (aka AtomPub) feature.
Remediation
References
Related Vulnerabilities
WordPress Ultimate Member Plugin Other Vulnerability (CVE-2022-3384)
WordPress Plugin Custom Post Type UI 'wp-admin/admin.php' Cross-Site Scripting (0.7)
WordPress Plugin jcwp youtube channel embed Cross-Site Scripting (1.5.2)
WordPress 5.3.x Multiple Vulnerabilities (5.3 - 5.3.3)
Apache HTTP Server CVE-2014-0098 Vulnerability (CVE-2014-0098)