WordPress Core < 2.6.1 - Cryptographic Weakness
Strategic Overview
Vulnerability Overview
The (1) get_edit_post_link and (2) get_edit_comment_link functions in wp-includes/link-template.php in WordPress before 2.6.1 do not force SSL communication in the intended situations, which might allow remote attackers to gain administrative access by sniffing the network for a cookie.
Technical Analysis
REMEDIATION: Update to version 2.6.1, or a newer patched version --- IDENTIFIER: CWE-757 (Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')) A protocol or its implementation supports interaction between multiple actors and allows those actors to negotiate which algorithm should be used as a protection mechanism such as encryption or authentication, but it does not select the strongest algorithm that is available to both parties.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C