CVE-2013-4340 — Wordpress vulnerability

CWE-2645 documents5 sources

Severity

3.5LOWNVD

EPSS

1.0%

top 23.24%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Wordpress Debian Wordpress

Timeline

PublishedSep 12

Latest updateMay 17

Description

wp-admin/includes/post.php in WordPress before 3.6.1 allows remote authenticated users to spoof the authorship of a post by leveraging the Author role and providing a modified user_ID parameter.

CVSS vector

AV:N/AC:M/C:N/I:P/A:NExploitability: 6.8 | Impact: 2.9

Affected Packages3 packages

▶debiandebian/wordpress< wordpress 3.6.1+dfsg-1 (bookworm)

▶Debianwordpress/wordpress< 3.6.1+dfsg-1+3

▶NVDwordpress/wordpress3.6

Patches

Patch: core.trac.wordpress.org ↗Patch: wordpress.org ↗Patch: core.trac.wordpress.org ↗

🔴Vulnerability Details

GHSA

GHSA-4rqg-qrg6-vxj8: wp-admin/includes/post↗2022-05-17

▶

OSV

CVE-2013-4340: wp-admin/includes/post↗2013-09-12

▶

📋Vendor Advisories

Debian

CVE-2013-4340: wordpress - wp-admin/includes/post.php in WordPress before 3.6.1 allows remote authenticated...↗2013

▶

💬Community

Bugzilla

CVE-2013-4338 CVE-2013-4339 CVE-2013-4340 CVE-2013-5738 CVE-2013-5739 wordpress: new security issues fixed in 3.6.1↗2013-09-12

▶