Description

wp-includes/capabilities.php in WordPress before 3.0.2, when a Multisite configuration is used, does not require the Super Admin role for the delete_users capability, which allows remote authenticated administrators to bypass intended access restrictions via a delete action.

Remediation

References

CVE-2010-5296

Related Vulnerabilities

WordPress Plugin Paid Memberships Pro-Restrict Member Access to Content, Courses, Communities-Free or Paid Subscriptions SQL Injection (2.6.6)

WordPress Plugin Event Espresso 4 Decaf-Event Registration Event Ticketing Cross-Site Request Forgery (4.9.82)

WordPress Plugin My Calendar Cross-Site Scripting (2.5.16)

WordPress Plugin Photo Gallery by 10Web-Mobile-Friendly Image Gallery Cross-Site Scripting (1.5.73)

WordPress Plugin Contact Form by BestWebSoft Email Header Injection (3.83)

Severity

Medium

Classification

CVE-2010-5296 CWE-264

Tags

Missing Update Known Vulnerabilities