CVE-2010-5297 Missing authorization in n/a
Authenticated site administrators in WordPress Multisite can bypass access restrictions to add users due to persistent configuration state issues.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2010-5297?
CVE-2010-5297 is a low-severity missing authorization vulnerability in Wordpress Wordpress, published on 21 Jan 2014. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
WordPress before 3.0.1, when a Multisite installation is used, permanently retains the "site administrators can add users" option once changed, which might allow remote authenticated administrators to bypass intended access restrictions in opportunistic circumstances via an add action after a temporary change.
Weakness: CWE-264
Which versions are affected by CVE-2010-5297?
It affects 1 product.
Products include Wordpress Wordpress.
How do I fix CVE-2010-5297?
Upgrade to a fixed version.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2010-5297 being exploited?
There is no known exploitation of CVE-2010-5297 in the wild and no public exploit code.
Other vulnerabilities in Wordpress Wordpress
Sources
Also known as DEBIAN-CVE-2010-5297, GHSA-8cg5-rjxh-5v62.