CVE-2011-1762 Missing authorization in wordpress

Medium 6.5 Published 18 Apr 2022 Updated 6 Aug 2024

Contributor-level users can bypass permission checks to publish posts, allowing unauthorized content modification in WordPress.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2011-1762?

CVE-2011-1762 is a medium-severity missing authorization vulnerability in Wordpress Wordpress, published on 18 Apr 2022. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A flaw exists in Wordpress related to the 'wp-admin/press-this.php 'script improperly checking user permissions when publishing posts. This may allow a user with 'Contributor-level' privileges to post as if they had 'publish_posts' permission.

Weakness: CWE-276, CWE-284

Which versions are affected by CVE-2011-1762?

It affects 1 product.

Products include Wordpress Wordpress.

How do I fix CVE-2011-1762?

Upgrade to a fixed version.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2011-1762 being exploited?

There is no known exploitation of CVE-2011-1762 in the wild and no public exploit code.

All Wordpress Wordpress vulnerabilities

Sources

Also known as DEBIAN-CVE-2011-1762, GHSA-fp52-jqr7-7249.