CVE-2013-4340 Privilege escalation in n/a

Low 3.5 Published 12 Sep 2013 Updated 6 Aug 2024

Authenticated users with Author role can spoof post authorship by modifying the user_ID parameter, allowing unauthorized content attribution.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2013-4340?

CVE-2013-4340 is a low-severity vulnerability in Wordpress Wordpress, published on 12 Sep 2013. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

wp-admin/includes/post.php in WordPress before 3.6.1 allows remote authenticated users to spoof the authorship of a post by leveraging the Author role and providing a modified user_ID parameter.

Weakness: CWE-264

Which versions are affected by CVE-2013-4340?

It affects 1 product.

Products include Wordpress Wordpress.

How do I fix CVE-2013-4340?

Upgrade to a fixed version.

Is CVE-2013-4340 being exploited?

There is no known exploitation of CVE-2013-4340 in the wild and no public exploit code.

All Wordpress Wordpress vulnerabilities

Sources

Also known as DEBIAN-CVE-2013-4340, GHSA-4rqg-qrg6-vxj8.