Description

WordPress before 3.4.1 does not properly restrict access to post contents such as private or draft posts, which allows remote authors or contributors to obtain sensitive information via unknown vectors.

Remediation

References

CVE-2012-3385

Related Vulnerabilities

WordPress Plugin WP-Curriculo Vitae Free Arbitrary File Upload (6.3)

WordPress Plugin Google Maps by BestWebSoft Cross-Site Scripting (1.3.5)

PrestaShop Incorrect Authorization Vulnerability (CVE-2020-5293)

WordPress Plugin WordPress Button Plugin MaxButtons Multiple Cross-Site Scripting Vulnerabilities (1.36)

WordPress Plugin Calendar Event Multi View SQL Injection (1.01)

Severity

Medium

Classification

CVE-2012-3385 CWE-264

Tags

Missing Update Known Vulnerabilities