wp-admin/async-upload.php in the media uploader in WordPress before 3.0.5 allows remote authenticated users to read (1) draft posts or (2) private posts via a modified attachment_id parameter.

http://www.cvedetails.com/cve/CVE-2011-0701/

http://core.trac.wordpress.org/changeset/17393

This vulnerability affects the following application versions:

  • WordPress 3.0
  • WordPress 3.0.1
  • WordPress 3.0.2
  • WordPress 3.0.3
  • WordPress 3.0.4

Skriv et svar

Din e-mailadresse vil ikke blive publiceret. Krævede felter er markeret med *