CVE-2012-2402 — Wordpress vulnerability

CWE-2646 documents5 sources

Severity

5.5MEDIUMNVD

EPSS

0.9%

top 23.85%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Wordpress Debian Wordpress

Timeline

PublishedApr 21

Latest updateMay 17

Description

wp-admin/plugins.php in WordPress before 3.3.2 allows remote authenticated site administrators to bypass intended access restrictions and deactivate network-wide plugins via unspecified vectors.

CVSS vector

AV:N/AC:L/C:N/I:P/A:PExploitability: 8.0 | Impact: 4.9

Affected Packages3 packages

▶debiandebian/wordpress< wordpress 3.3.2+dfsg-1 (bookworm)

▶Debianwordpress/wordpress< 3.3.2+dfsg-1+3

▶NVDwordpress/wordpress3.3.1+77

Patches

Patch: wordpress.org ↗Patch: wordpress.org ↗

🔴Vulnerability Details

GHSA

GHSA-4qcm-5888-4f65: wp-admin/plugins↗2022-05-17

▶

OSV

CVE-2012-2402: wp-admin/plugins↗2012-04-21

▶

📋Vendor Advisories

Debian

CVE-2012-2402: wordpress - wp-admin/plugins.php in WordPress before 3.3.2 allows remote authenticated site ...↗2012

▶

💬Community

Bugzilla

CVE-2012-2402 wordpress (X < v3.3.2): Remote authenticated site administrators able to deactivate network-wide plugins under certain circumstances↗2012-04-23

▶

Bugzilla

CVE-2012-2399 CVE-2012-2400 CVE-2012-2402 CVE-2012-2403 CVE-2012-2404 wordpress various flaws [epel-5]↗2012-04-23

▶