Published: 10/07/2009 Updated: 08/11/2018

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

VMScore: 540

Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N

The forgotten mail interface in WordPress and WordPress MU prior to 2.8.1 exhibits different behavior for a password request depending on whether the user account exists, which allows remote malicious users to enumerate valid usernames. NOTE: the vendor reportedly disputes the significance of this issue, indicating that the behavior exists for "user convenience."

Vulnerable Product	Search on Vulmon	Subscribe to Product
wordpress wordpress
wordpress wordpress mu

Debian Bug report logs - #536724 wordpress: CORE-2009-0515 priviledges unchecked and multiple information disclosures Package: wordpress; Maintainer for wordpress is Craig Small <csmall@debianorg>; Source for wordpress is src:wordpress (PTS, buildd, popcon) Reported by: "Michael S Gilbert" <michaelsgilbert@gmailcom&g ...

Debian Bug report logs - #537146 CVE-2009-2431, CVE-2009-2432 Package: wordpress; Maintainer for wordpress is Craig Small <csmall@debianorg>; Source for wordpress is src:wordpress (PTS, buildd, popcon) Reported by: Giuseppe Iuculano <giuseppe@iuculanoit> Date: Wed, 15 Jul 2009 14:00:02 UTC Severity: important Tags ...

Debian Bug report logs - #531736 CVE-2008-6767, CVE-2008-6762 Package: wordpress; Maintainer for wordpress is Craig Small <csmall@debianorg>; Source for wordpress is src:wordpress (PTS, buildd, popcon) Reported by: Giuseppe Iuculano <giuseppe@iuculanoit> Date: Wed, 3 Jun 2009 17:27:02 UTC Severity: normal Tags: s ...

Core Security Technologies Advisory - A vulnerability was found in the way that WordPress handles some URL requests This results in unprivileged users viewing the content of plugins configuration pages, and also in some plugins modifying plugin options and injecting JavaScript code Arbitrary native code may be run by a malicious attacker if the b ...

CWE-16 http://www.securityfocus.com/bid/35581 http://www.vupen.com/english/advisories/2009/1833 http://corelabs.coresecurity.com/index.php?action=view&type=advisory&name=WordPress_Privileges_Unchecked http://securitytracker.com/id?1022528 http://www.osvdb.org/55714 https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00676.html https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00632.html https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00597.html https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00608.html http://www.exploit-db.com/exploits/9110 http://www.securityfocus.com/archive/1/504795/100/0/threaded https://nvd.nist.gov https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=536724

CVE-2009-2336

Vulnerability Summary

Vendor Advisories

Exploits

References

Vulmon Search

About

Products

Connect