Description

Cross-site request forgery (CSRF) vulnerability in the AdminPanel in WordPress 2.1.1 and earlier allows remote attackers to perform privileged actions as administrators, as demonstrated using the delete action in wp-admin/post.php. NOTE: this issue can be leveraged to perform cross-site scripting (XSS) attacks and steal cookies via the post parameter.

Remediation

References

CVE-2007-1244

Related Vulnerabilities

WordPress Plugin LearnPress-WordPress LMS Local File Inclusion (4.2.6.8.2)

Zenphoto Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2012-2641)

WordPress Plugin Integration for Gravity Forms and Pipedrive Cross-Site Scripting (1.0.6)

WordPress Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2019-16221)

Joomla Permissions, Privileges, and Access Controls Vulnerability (CVE-2012-1611)

Severity

Medium

Classification

CVE-2007-1244

Tags

Missing Update Known Vulnerabilities