Description

wp-admin/includes/post.php in WordPress before 3.6.1 allows remote authenticated users to spoof the authorship of a post by leveraging the Author role and providing a modified user_ID parameter.

Remediation

References

CVE-2013-4340

Related Vulnerabilities

Jboss EAP Deserialization of Untrusted Data Vulnerability (CVE-2019-16942)

Oracle JRE CVE-2018-2663 Vulnerability (CVE-2018-2663)

concrete5 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2015-4724)

Mailman Other Vulnerability (CVE-2004-1143)

Oracle JRE CVE-2018-2579 Vulnerability (CVE-2018-2579)

Severity

Low

Classification

CVE-2013-4340 CWE-264

Tags

Missing Update Known Vulnerabilities