4.3

CVE-2015-5715

EPSS 28.52%
Published 22.05.2016 01:59:02
Last modified 12.04.2025 10:46:40
Source cve@mitre.org
Teams watchlist Login
Open Login

The mw_editPost function in wp-includes/class-wp-xmlrpc-server.php in the XMLRPC subsystem in WordPress before 4.3.1 allows remote authenticated users to bypass intended access restrictions, and arrange for a private post to be published and sticky, via unspecified vectors.

Affected products Warnungen 0 Metrics 3 CWE 0 References 12

Data is provided by the National Vulnerability Database (NVD)

Wordpress ≫ Wordpress Version <= 4.3.0

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	28.52%	0.964

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	4.3	2.8	1.4	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
nvd@nist.gov	4	8	2.9	AV:N/AC:L/Au:S/C:N/I:P/A:N

http://www.debian.org/security/2015/dsa-3383

http://www.debian.org/security/2015/dsa-3375

http://www.securitytracker.com/id/1033979

https://codex.wordpress.org/Version_4.3.1

Patch

Vendor Advisory

https://wordpress.org/news/2015/09/wordpress-4-3-1/

Patch

Vendor Advisory

http://www.securityfocus.com/bid/76748

https://github.com/WordPress/WordPress/commit/9c57f3a4291f2311ae05f22c10eedeb0f69337ab

Patch

https://security-tracker.debian.org/tracker/CVE-2015-5715

https://wpvulndb.com/vulnerabilities/8188

https://nvd.nist.gov/vuln/detail/CVE-2015-5715

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2015-5715

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2015-5715

EUVD