CVE-2008-6767 Missing authorization in n/a

Critical 10.0 Published 28 Apr 2009 Updated 7 Aug 2024

Remote attackers can trigger application upgrades without authentication, potentially causing denial of service or unauthorized state changes.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2008-6767?

CVE-2008-6767 is a critical missing authorization vulnerability in Wordpress Wordpress, published on 28 Apr 2009. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

wp-admin/upgrade.php in WordPress, probably 2.6.x, allows remote attackers to upgrade the application, and possibly cause a denial of service (application outage), via a direct request.

Which versions are affected by CVE-2008-6767?

It affects 1 product.

Products include Wordpress Wordpress.

How do I fix CVE-2008-6767?

Upgrade to a fixed version.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2008-6767 being exploited?

There is no known exploitation of CVE-2008-6767 in the wild and no public exploit code.

All Wordpress Wordpress vulnerabilities

Sources

Also known as DEBIAN-CVE-2008-6767, GHSA-xvh9-mfm3-cvfq.