4
CVE-2012-4421
- EPSS 1.9%
- Veröffentlicht 14.09.2012 19:55:01
- Zuletzt bearbeitet 16.06.2026 23:44:59
- Erkennungen
LoginWordPress Core < 3.4.2 - Missing Authorization Checks on create_post
The create_post function in wp-includes/class-wp-atom-server.php in WordPress before 3.4.2 does not perform a capability check, which allows remote authenticated users to bypass intended access restrictions and publish new posts by leveraging the Contributor role and using the Atom Publishing Protocol (aka AtomPub) feature.
Mögliche Gegenmaßnahme
WordPress: Update to version 3.4.2, or a newer patched version
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Weitere Schwachstelleninformationen
SystemWordPress Core
≫
Produkt
WordPress
Version
[*, 3.4.2)
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 1.9% | 0.77 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| NIST | 4 | 8 | 2.9 |
AV:N/AC:L/Au:S/C:N/I:P/A:N
|
http://codex.wordpress.org/Version_3.4.2
http://core.trac.wordpress.org/changeset?old_path=%2Ftags%2F3.4.1&old=21780&new_path=%2Ftags%2F3.4.2&new=21780#file2
http://openwall.com/lists/oss-security/2012/09/13/4
https://www.wordfence.com/threat-intel/vulnerabilities/id/14689386-fca5-48a6-9494-4a79b920d5f8