Description

wp-admin/press-this.php in WordPress before 3.0.6 does not enforce the publish_posts capability requirement, which allows remote authenticated users to perform publish actions by leveraging the Contributor role.

Remediation

References

CVE-2011-5270

Related Vulnerabilities

Oracle Database Server CVE-2010-0866 Vulnerability (CVE-2010-0866)

WordPress Plugin Debug Log Manager Cross-Site Request Forgery (2.2.1)

Joomla! Core 3.x.x Local File Inclusion (3.0.0 - 3.9.25)

WordPress Plugin Amelia-Events & Appointments Booking Calendar Cross-Site Scripting (1.0.46)

XWiki Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2022-23622)

Severity

Medium

Classification

CVE-2011-5270 CWE-264

Tags

Missing Update Known Vulnerabilities