WordPress Core < 4.2.3 - Authorization Bypass
2015-07-23 00:00
Netanel RubinStrategic Overview
StatusPatched in 3.7.9
Affected CoreWordPress 4.2
Affected Version
3.7 – 4.2.2 · 7 branchesCVSS6.5Medium
CVE
CVE-2015-5623Vulnerability Overview
WordPress before 4.2.3 does not properly verify the edit_posts capability, which allows remote authenticated users to bypass intended access restrictions and create drafts by leveraging the Subscriber role, as demonstrated by a post-quickdraft-save action to wp-admin/post.php.
Technical Analysis
REMEDIATION: Update to one of the following versions, or a newer patched version: 3.7.9, 3.8.9, 3.9.7, 4.0.6, 4.1.6, 4.2.3 --- IDENTIFIER: CWE-862 (Missing Authorization) The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C