CVE-2009-2854

Wordpress before 2.8.3 does not check capabilities for certain actions, which allows remote attackers to make unauthorized edits or additions via a direct…

published August 18, 2009

CVSS
—
EPSS
2%
Percentile
83.1
In the wild
Unconfirmed
What it is

Wordpress before 2.8.3 does not check capabilities for certain actions, which allows remote attackers to make unauthorized edits or additions via a direct request to (1) edit-comments.php, (2) edit-pages.php, (3) edit.php, (4) edit-category-form.php, (5) edit-link-category-form.php, (6) edit-tag-form.php, (7) export.php, (8) import.php, or (9) link-add.php in wp-admin/.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02295 · 83.1th percentile
Published
2009-08-18T20:41Z
EPSS history
Timeline
  • 18 AUG 20:41Z
    Wordpress before 2.8.3 does not check capabilities for certain actions, which allows remote attackers to make unauthorized edits or additions via a direct…
    cvelistv5