Description
wp-admin/plugins.php in WordPress before 3.4.2, when the multisite feature is enabled, does not check for network-administrator privileges before performing a network-wide activation of an installed plugin, which might allow remote authenticated users to make unintended plugin changes by leveraging the Administrator role.
Remediation
References
Related Vulnerabilities
WordPress Plugin FreshMail For WordPress Multiple SQL Injection Vulnerabilities (1.5.8)
WordPress Plugin Apptivo eCommerce Multiple Cross-Site Scripting Vulnerabilities (1.1.5)
WordPress Plugin Calendar by WD-Responsive Event Calendar for WordPress SQL Injection (1.5.51)
MediaWiki CVE-2023-45372 Vulnerability (CVE-2023-45372)
Ruby Permissions, Privileges, and Access Controls Vulnerability (CVE-2012-4466)