WordPress 'xmlrpc.php' Remote Security Bypass Vulnerability

Bugtraq ID:	45299
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 09 2010 12:00AM
Updated:	Apr 16 2015 06:04PM
Credit:	The vendor reported this issue.
Vulnerable:	WordPress WordPress 3.0.2 WordPress WordPress 3.0.1
Not Vulnerable:	WordPress WordPress 3.0.3

WordPress 'xmlrpc.php' Remote Security Bypass Vulnerability

WordPress is prone to a security-bypass vulnerability because the application fails to properly perform user-profile checks.

Remote attackers with 'Author' and 'Contributor' privileges can exploit this issue to improperly edit, publish, or delete posts under certain circumstances.

Note that successful exploitation requires the application to be enabled with the remote publishing feature.

WordPress versions prior to 3.0.3 are vulnerable; other versions may be affected.

WordPress 'xmlrpc.php' Remote Security Bypass Vulnerability

Attackers can exploit this issue with a web browser.

WordPress 'xmlrpc.php' Remote Security Bypass Vulnerability

Solution:
Vendor updates are available. Please see the references for more information.

WordPress 'xmlrpc.php' Remote Security Bypass Vulnerability

References:

• Download WordPress (WordPress)
  
• Version 3.0.3 (Wordpress)
  
• WordPress 3.0.3 (Wordpress)