4 matches found
CVE-2008-5695
CVE-2008-5695 affects WordPress MU pre-1.3.2 and WordPress pre-2.3.2, where wp-admin/options.php fails to properly validate option update requests. This allows remote authenticated users with manage_options and upload_files to execute arbitrary code by uploading a PHP script and adding its pathna...
CVE-2009-2335
CVE-2009-2335 affects WordPress and WordPress MU prior to 2.8.1, where a failed login behaves differently depending on whether the user account exists, enabling remote enumeration of valid usernames. The vendor reportedly disputes the significance of the issue, calling the behavior for user conve...
CVE-2009-2336
CVE-2009-2336 affects WordPress and WordPress MU prior to 2.8.1, where the password reset/request behavior differs based on account existence, enabling remote username enumeration. The issue has a CVSS 2.0 base score of 5.0 (Network, Low attack complexity, No authentication). The vendor reportedl...