WordPress is prone to an information-disclosure vulnerability because it fails to properly restrict access to trashed posts. An attacker can exploit this vulnerability to view other authors' trashed posts, which may aid in further attacks. Versions prior to WordPress 2.9.2 are vulnerable.

Updates are available. Please see the references for more information.

• http://tmacuk.co.uk/?p=180
• http://wordpress.org/
• http://wordpress.org/development/2010/02/wordpress-2-9-2/
• http://www.securityfocus.com/bid/38368

---

Updated on 2015-03-25