CVE-2009-2334

10.07.2009, 21:00

wp-admin/admin.php in WordPress and WordPress MU before 2.8.1 does not require administrative authentication to access the configuration of a plugin, which allows remote attackers to specify a configuration file in the page parameter to obtain sensitive information or modify this file, as demonstrated by the (1) collapsing-archives/options.txt, (2) akismet/readme.txt, (3) related-ways-to-take-action/options.php, (4) wp-security-scan/securityscan.php, and (5) wp-ids/ids-admin.php files. NOTE: this can be leveraged for cross-site scripting (XSS) and denial of service.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Vector
NIST	NIST	4.9 UNKNOWN	NETWORK	MEDIUM	AV:N/AC:M/Au:S/C:P/I:P/A:N
mitre	CNA	---			---
CVE	ADP	---			---

Base Score

CVSS 3.x

EPSS Score

Percentile: 94%

Vendor	Product	Version
wordpress	wordpress	𝑥 ≤ 2.7.1
wordpress	wordpress	0.6.2
wordpress	wordpress	0.6.2:beta_2
wordpress	wordpress	0.6.2.1
wordpress	wordpress	0.6.2.1:beta_2
wordpress	wordpress	0.7
wordpress	wordpress	0.71
wordpress	wordpress	0.71-gold
wordpress	wordpress	0.72
wordpress	wordpress	0.72:beta1
wordpress	wordpress	0.72:beta2
wordpress	wordpress	0.72:rc1
wordpress	wordpress	0.711
wordpress	wordpress	1.0
wordpress	wordpress	1.0:rc1
wordpress	wordpress	1.0:rc2
wordpress	wordpress	1.0:rc3
wordpress	wordpress	1.0:rc4
wordpress	wordpress	1.0-platinum
wordpress	wordpress	1.0.1
wordpress	wordpress	1.0.1-miles
wordpress	wordpress	1.0.2
wordpress	wordpress	1.0.2-blakey
wordpress	wordpress	1.2
wordpress	wordpress	1.2:beta
wordpress	wordpress	1.2-delta
wordpress	wordpress	1.2-mingus
wordpress	wordpress	1.2.1
wordpress	wordpress	1.2.2
wordpress	wordpress	1.3.1
wordpress	wordpress	1.4
wordpress	wordpress	1.5
wordpress	wordpress	1.5-strayhorn
wordpress	wordpress	1.5.1
wordpress	wordpress	1.5.1.1
wordpress	wordpress	1.5.1.2
wordpress	wordpress	1.5.1.3
wordpress	wordpress	1.5.2
wordpress	wordpress	1.6
wordpress	wordpress	2.0
wordpress	wordpress	2.0.1
wordpress	wordpress	2.0.2
wordpress	wordpress	2.0.3
wordpress	wordpress	2.0.4
wordpress	wordpress	2.0.5
wordpress	wordpress	2.0.6
wordpress	wordpress	2.0.7
wordpress	wordpress	2.0.8
wordpress	wordpress	2.0.9
wordpress	wordpress	2.0.10
wordpress	wordpress	2.0.10_rc1:_rc1
wordpress	wordpress	2.0.10_rc2:_rc2
wordpress	wordpress	2.0.11
wordpress	wordpress	2.1
wordpress	wordpress	2.1:alpha_3
wordpress	wordpress	2.1.1
wordpress	wordpress	2.1.2
wordpress	wordpress	2.1.3
wordpress	wordpress	2.1.3_rc1:_rc1
wordpress	wordpress	2.1.3_rc2:_rc2
wordpress	wordpress	2.2
wordpress	wordpress	2.2.0
wordpress	wordpress	2.2.1
wordpress	wordpress	2.2.2
wordpress	wordpress	2.2.3
wordpress	wordpress	2.2_revision5002:_revision5002
wordpress	wordpress	2.2_revision5003:_revision5003
wordpress	wordpress	2.3
wordpress	wordpress	2.3:beta3
wordpress	wordpress	2.3:rc1
wordpress	wordpress	2.3.1
wordpress	wordpress	2.3.1:rc1
wordpress	wordpress	2.3.2
wordpress	wordpress	2.3.3
wordpress	wordpress	2.5
wordpress	wordpress	2.5.1
wordpress	wordpress	2.6
wordpress	wordpress	2.6.1
wordpress	wordpress	2.6.3
wordpress	wordpress	2.6.5
wordpress	wordpress_mu	𝑥 ≤ 2.7
wordpress	wordpress_mu	1.1
wordpress	wordpress_mu	1.1.1
wordpress	wordpress_mu	1.2
wordpress	wordpress_mu	1.2.1
wordpress	wordpress_mu	1.2.2
wordpress	wordpress_mu	1.2.3
wordpress	wordpress_mu	1.2.4
wordpress	wordpress_mu	1.2.4:rc1
wordpress	wordpress_mu	1.2.5a:a
wordpress	wordpress_mu	1.3
wordpress	wordpress_mu	1.3.1
wordpress	wordpress_mu	1.3.2
wordpress	wordpress_mu	1.3.3
wordpress	wordpress_mu	1.5:rc1
wordpress	wordpress_mu	1.5.1
wordpress	wordpress_mu	2.6
wordpress	wordpress_mu	2.6.1
wordpress	wordpress_mu	2.6.2
wordpress	wordpress_mu	2.6.3
wordpress	wordpress_mu	2.6.5

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

wordpress

bullseye (security)	5.7.11+dfsg1-0+deb11u1 fixed
bullseye	5.7.11+dfsg1-0+deb11u1 fixed
bookworm	6.1.6+dfsg1-0+deb12u1 fixed
bookworm (security)	6.1.6+dfsg1-0+deb12u1 fixed
sid	6.6.1+dfsg1-1 fixed
trixie	6.6.1+dfsg1-1 fixed