CVE-2010-5296

Published Jan 21, 2014

Last updated 11 years ago

Overview

Description
wp-includes/capabilities.php in WordPress before 3.0.2, when a Multisite configuration is used, does not require the Super Admin role for the delete_users capability, which allows remote authenticated administrators to bypass intended access restrictions via a delete action.
Source
cve@mitre.org
NVD status
Analyzed

Risk scores

CVSS 2.0

Type
Primary
Base score
4.9
Impact score
4.9
Exploitability score
6.8
Vector string
AV:N/AC:M/Au:S/C:P/I:P/A:N

Weaknesses

nvd@nist.gov
CWE-264

Social media

Hype score
Not currently trending

Configurations