Description
WordPress is prone to a security bypass vulnerability because the application fails to properly perform user-profile checks. Exploiting this issue could allow an attacker to perform otherwise restricted actions and subsequently publish posts under certain circumstances. Note that successful exploitation requires 'Contributor-level' privileges. WordPress versions prior to 3.1.2 are vulnerable.
Remediation
Update to WordPress version 3.0.6, 3.1.2 or latest
References
Related Vulnerabilities
WordPress Plugin Redux Framework Cross-Site Request Forgery (4.1.23)
WordPress Plugin Social Sharing Toolkit Cross-Site Scripting (2.6)
XWiki Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2023-37909)
WordPress Plugin Product list Widget for Woocommerce Cross-Site Scripting (1.0)