Description

WordPress before 3.5.2 does not properly check the capabilities of roles, which allows remote authenticated users to bypass intended restrictions on publishing and authorship reassignment via unspecified vectors.

Remediation

References

CVE-2013-2200

Related Vulnerabilities

WordPress Plugin YITH WooCommerce Compare PHP Object Injection (2.0.9)

Jenkins Server-Side Request Forgery (SSRF) Vulnerability (CVE-2018-1000067)

Joomla! Core 1.0.x Session Fixation (1.0.0 - 1.0.12)

PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2016-3141)

MediaWiki Incorrect Default Permissions Vulnerability (CVE-2017-0369)

Severity

Medium

Classification

CVE-2013-2200 CWE-264

Tags

Missing Update Known Vulnerabilities