Description

WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 does not prevent rendering for (1) admin or (2) login pages inside a frame in a third-party HTML document, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site.

Remediation

References

CVE-2011-3127

Related Vulnerabilities

WordPress Plugin WP Social Invitations Cross-Site Scripting (1.4.4.2)

WordPress Plugin Ldap WP Login/Active Directory Integration Multiple Vulnerabilities (3.0.1)

WordPress Plugin WHMCS Bridge Cross-Site Scripting (6.2)

WordPress Plugin underConstruction Cross-Site Request Forgery (1.08)

WordPress Plugin Simple Login Log SQL Injection (1.1.1)

Severity

Medium

Classification

CVE-2011-3127 CWE-20

Tags

Missing Update Known Vulnerabilities