WordPress Password Protection Security Bypass Vulnerability

Bugtraq ID:	38876
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Mar 22 2010 12:00AM
Updated:	Mar 22 2010 12:00AM
Credit:	MustLive
Vulnerable:	WordPress WordPress 2.9.2 WordPress WordPress 2.9.1 WordPress WordPress 2.8.6 WordPress WordPress 2.8.5 WordPress WordPress 2.8.4 WordPress WordPress 2.8.3 WordPress WordPress 2.8.2 WordPress WordPress 2.8.1 WordPress WordPress 2.6.5 WordPress WordPress 2.6.2 WordPress WordPress 2.6.1 WordPress WordPress 2.5.1 WordPress WordPress 2.3.3 WordPress WordPress 2.3.2 WordPress WordPress 2.3.1 WordPress WordPress 2.2.3 WordPress WordPress 2.2.2 WordPress WordPress 2.2.1 WordPress WordPress 2.1.3 WordPress WordPress 2.1.2 WordPress WordPress 2.1.1 WordPress WordPress 2.0.11 WordPress WordPress 2.0.10 WordPress WordPress 2.0.7 WordPress WordPress 2.0.6 WordPress WordPress 2.0.5 WordPress WordPress 2.0.4 WordPress WordPress 2.0.3 WordPress WordPress 2.0.2 WordPress WordPress 2.0.1 WordPress WordPress 2.0 WordPress WordPress 2.9 WordPress WordPress 2.8 WordPress WordPress 2.6 WordPress WordPress 2.5 WordPress WordPress 2.3 WordPress WordPress 2.2 Revision 5003 WordPress WordPress 2.2 Revision 5002 WordPress WordPress 2.2 WordPress WordPress 2.1.3-RC2 WordPress WordPress 2.1.3-RC1 WordPress WordPress 2.1 WordPress WordPress 2.0.10-RC2 WordPress WordPress 2.0.10-RC1
Not Vulnerable:

WordPress Password Protection Security Bypass Vulnerability

WordPress is prone to a security-bypass vulnerability.

Attackers may exploit this issue to access certain content that may contain sensitive information.

WordPress 2.9.2 and 2.0.11 are vulnerable; other versions may also be affected.

WordPress Password Protection Security Bypass Vulnerability

An attacker can exploit this issue via a browser.

WordPress Password Protection Security Bypass Vulnerability

References:

• Vulnerabilities in WordPress ("MustLive" )
  
• Wordpress church_admin Plugin "id" Cross-Site Scripting Vulnerability (Sammy Forgit)