medium4.9
CVE-2010-5296
wp-includes/capabilities.php in WordPress before 3.0.2, when a Multisite configuration is used, does not require the Super Admin role for the delete_users capa…
Impact
wp-includes/capabilities.php in WordPress before 3.0.2, when a Multisite configuration is used, does not require the Super Admin role for the delete_users capability, which allows remote authenticated administrators to bypass intended access restrictions via a delete action.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Wordpress | Wordpress | through 3.0.1 Versions 2.0, 2.0.1, 2.0.2, 2.0.4, 2.0.5 |