Description

xmlrpc (xmlrpc.php) in WordPress 2.1.2, and probably earlier, allows remote authenticated users with the contributor role to bypass intended access restrictions and invoke the publish_posts functionality, which can be used to "publish a previously saved post."

Remediation

References

CVE-2007-1893

Related Vulnerabilities

Roundcube Resource Management Errors Vulnerability (CVE-2011-4078)

WordPress Plugin Companion Sitemap Generator Cross-Site Request Forgery (3.6.6)

WordPress Plugin Total GDPR Compliance Lite-WordPress for GDPR Compatibility includes Backdoor [Only if downloaded via the vendor website] (1.0.4)

WordPress Plugin CiviCRM Remote Code Execution (5.24.2)

MediaWiki Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2014-9507)

Severity

Medium

Classification

CVE-2007-1893 CWE-264

Tags

Missing Update Known Vulnerabilities