CVE-2009-2334
- State
- Published
- Severity
- Not scored
- Published
- Jul 10, 2009
- Updated
- Aug 7, 2024
- Reserved
- Jul 5, 2009
Description
wp-admin/admin.php in WordPress and WordPress MU before 2.8.1 does not require administrative authentication to access the configuration of a plugin, which allows remote attackers to specify a configuration file in the page parameter to obtain sensitive information or modify this file, as demonstrated by the (1) collapsing-archives/options.txt, (2) akismet/readme.txt, (3) related-ways-to-take-action/options.php, (4) wp-security-scan/securityscan.php, and (5) wp-ids/ids-admin.php files. NOTE: this can be leveraged for cross-site scripting (XSS) and denial of service.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- FEDORA-2009-8538vendor-advisory
- http://corelabs.coresecurity.com/index.php?action=view&type=advisory&name=WordPress_Privileges_Unchecked
- FEDORA-2009-7729vendor-advisory
- http://wordpress.org/development/2009/07/wordpress-2-8-1/
- 20090708 CORE-2009-01515 - WordPress Privileges Unchecked in admin.php and Multiple Informationmailing-list
- 1022528vdb-entry
- FEDORA-2009-7701vendor-advisory
- ADV-2009-1833vdb-entry
- DSA-1871vendor-advisory
- FEDORA-2009-8529vendor-advisory
- 55712vdb-entry
- 35584vdb-entry
- 55715vdb-entry
- 9110exploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.