Description

wp-includes/capabilities.php in WordPress before 3.0.2, when a Multisite configuration is used, does not require the Super Admin role for the delete_users capability, which allows remote authenticated administrators to bypass intended access restrictions via a delete action.

Remediation

References

CVE-2010-5296

Related Vulnerabilities

WordPress Plugin WP-Live Chat by 3CX Remote Code Execution (7.0.01)

Django Incorrect Regular Expression Vulnerability (CVE-2018-7536)

WordPress Plugin Booking Multiple Vulnerabilities (2.5)

IBM RTC Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2018-1407)

WordPress Plugin Row Seats Core Unspecified Vulnerability (2.66)

Severity

Medium

Classification

CVE-2010-5296 CWE-264

Tags

Missing Update Known Vulnerabilities