CVE-2010-5106
published 2012-09-14CVE-2010-5106: The XML-RPC remote publishing interface in xmlrpc.php in WordPress before 3.0.3 does not properly check capabilities, which allows remote authenticated users…
PriorityP433medium6.5CVSS 2.0
AVNACLAuSCPIPAP
EPSS
2.18%
80.4th percentile
The XML-RPC remote publishing interface in xmlrpc.php in WordPress before 3.0.3 does not properly check capabilities, which allows remote authenticated users to bypass intended access restrictions, and publish, edit, or delete posts, by leveraging the Author or Contributor role.
Affected
73 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | wordpress | < wordpress 3.0.3-1 (bookworm) | wordpress 3.0.3-1 (bookworm) |
| wordpress | wordpress | <= 3.0.2 | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
CVSS provenance
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
osv6.5MEDIUM
vendor_debian6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-2w3h-g44g-mrhv: The XML-RPC remote publishing interface in xmlrpc
ghsa_unreviewed·2022-05-17
CVE-2010-5106 [MEDIUM] GHSA-2w3h-g44g-mrhv: The XML-RPC remote publishing interface in xmlrpc
The XML-RPC remote publishing interface in xmlrpc.php in WordPress before 3.0.3 does not properly check capabilities, which allows remote authenticated users to bypass intended access restrictions, and publish, edit, or delete posts, by leveraging the Author or Contributor role.
OSV
CVE-2010-5106: The XML-RPC remote publishing interface in xmlrpc
osv·2012-09-14·CVSS 6.5
CVE-2010-5106 [MEDIUM] CVE-2010-5106: The XML-RPC remote publishing interface in xmlrpc
The XML-RPC remote publishing interface in xmlrpc.php in WordPress before 3.0.3 does not properly check capabilities, which allows remote authenticated users to bypass intended access restrictions, and publish, edit, or delete posts, by leveraging the Author or Contributor role.
Debian
CVE-2010-5106: wordpress - The XML-RPC remote publishing interface in xmlrpc.php in WordPress before 3.0.3 ...
vendor_debian·2010·CVSS 6.5
CVE-2010-5106 [MEDIUM] CVE-2010-5106: wordpress - The XML-RPC remote publishing interface in xmlrpc.php in WordPress before 3.0.3 ...
The XML-RPC remote publishing interface in xmlrpc.php in WordPress before 3.0.3 does not properly check capabilities, which allows remote authenticated users to bypass intended access restrictions, and publish, edit, or delete posts, by leveraging the Author or Contributor role.
Scope: local
bookworm: resolved (fixed in 3.0.3-1)
bullseye: resolved (fixed in 3.0.3-1)
forky: resolved (fixed in 3.0.3-1)
sid: resolved (fixed in 3.0.3-1)
trixie: resolved (fixed in 3.0.3-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2012-09-14
Published