Description

The create_post function in wp-includes/class-wp-atom-server.php in WordPress before 3.4.2 does not perform a capability check, which allows remote authenticated users to bypass intended access restrictions and publish new posts by leveraging the Contributor role and using the Atom Publishing Protocol (aka AtomPub) feature.

Remediation

References

CVE-2012-4421

Related Vulnerabilities

Apache HTTP Server Uncontrolled Resource Consumption Vulnerability (CVE-2023-45802)

WordPress Plugin Uploader Cross-Site Scripting and Arbitrary File Upload Vulnerabilities (1.0.4)

SharePoint Deserialization of Untrusted Data Vulnerability (CVE-2021-34520)

PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2014-9427)

WordPress Plugin Variation Swatches for WooCommerce Cross-Site Scripting (2.1.1)

Severity

Medium

Classification

CVE-2012-4421 CWE-264

Tags

Missing Update Known Vulnerabilities