Detections
Analytics

WordPress < 3.0.3 XML-RPC Interface Access Restriction Bypass

medium Nessus Network Monitor Plugin ID 9112

Synopsis

The remote server is hosting an outdated installation of WordPress that is vulnerable to a security bypass attack.

Description

Versions of WordPress prior to 3.0.3 are susceptible to a security bypass vulnerability. Certain access control restrictions are not properly enforced, which could allow a remote, authenticated user to perform unauthorized actions such as editing, publishing, or deleting existing posts using specially crafted XML-RPC requests. Note that a user must have 'Author Level' or 'Contributor Level' permissions to exploit this issue. Additionally, remote publishing (which is disabled by default) must be enabled.

Solution

Upgrade to WordPress 3.0.3, or later.

See Also

http://codex.wordpress.org/Changelog/3.0.1

https://core.trac.wordpress.org/ticket/14119

Plugin Details

Severity: Medium

ID: 9112

Family: CGI

Published: 2/26/2016

Updated: 3/6/2019

Nessus ID: 51341

Risk Information

VPR

Risk Factor: Medium

Score: 6.6

CVSS v2

Risk Factor: Medium

Base Score: 4.9

Temporal Score: 4

Vector: CVSS2#AV:N/AC:M/Au:S/C:N/I:P/A:P

CVSS v3

Risk Factor: Medium

Base Score: 4.2

Temporal Score: 3.9

Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:wordpress:wordpress

Patch Publication Date: 6/27/2010

Vulnerability Publication Date: 6/27/2010

Reference Information

CVE: CVE-2010-5106

BID: 45299