NetSight
IP …
medium4.9Public exploit code

CVE-2009-2334

wp-admin/admin.php in WordPress and WordPress MU before 2.8.1 does not require administrative authentication to access the configuration of a plugin, which all…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

wp-admin/admin.php in WordPress and WordPress MU before 2.8.1 does not require administrative authentication to access the configuration of a plugin, which allows remote attackers to specify a configuration file in the page parameter to obtain sensitive information or modify this file, as demonstrated by the (1) collapsing-archives/options.txt, (2) akismet/readme.txt, (3) related-ways-to-take-action/options.php, (4) wp-security-scan/securityscan.php, and (5) wp-ids/ids-admin.php files. NOTE: this can be leveraged for cross-site scripting (XSS) and denial of service.

Affected products

VendorProductAffected versions
WordpressWordpress
through 2.7.1
Versions 0.6.2, 0.6.2.1, 0.7, 0.71, 0.71-gold
WordpressWordpress Mu
through 2.7
Versions 1.1, 1.1.1, 1.2, 1.2.1, 1.2.2

Weakness classification

CWE-287

References