Description

WordPress is prone to a security bypass vulnerability because the application fails to properly perform user-profile checks. Remote attackers with 'Author' and 'Contributor' privileges can exploit this issue to improperly edit, publish, or delete posts under certain circumstances. Note that successful exploitation requires the application to be enabled with the remote publishing feature. WordPress version 3.0.2 is vulnerable; prior versions may also be affected.

Remediation

Update to WordPress version 3.0.3 or latest

References

http://www.securityfocus.com/bid/45299/

http://secunia.com/advisories/42553/

https://wordpress.org/news/2010/12/wordpress-3-0-3/

Related Vulnerabilities

WordPress Plugin Banner Cycler Cross-Site Request Forgery (1.4)

WordPress Plugin Limit Login Attempts Cross-Site Scripting (4.0.43)

MySQL CVE-2021-2171 Vulnerability (CVE-2021-2171)

WordPress 5.3.x Directory Traversal (5.3 - 5.3.17)

WordPress Plugin Insert or Embed Articulate Content into WordPress Security Bypass (4.2996)

Severity

High

Classification

CVE-2010-5106 CWE-264 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Tags

Missing Update Authentication Bypass