CVE-2009-2853: Critical severity wordpress vulnerability

Published Aug 18, 2009

Updated

Wordpress before 2.8.3 allows remote attackers to gain privileges via a direct request to (1) admin-footer.php, (2) edit-category-form.php, (3) edit-form-advanced.php, (4) edit-form-comment.php, (5) edit-link-category-form.php, (6) edit-link-form.php, (7) edit-page-form.php, and (8) edit-tag-form.php in wp-admin/.

Affected Software

57 affected components

WordPress=2.0.11

WordPress=2.3.1-rc1

WordPress=2.0

WordPress=2.1.1

WordPress=2.2.3

WordPress=2.0.2

WordPress=1.2-beta

WordPress=2.0.6

WordPress=2.0.1

WordPress=2.0.4

WordPress=0.711

WordPress=2.2

WordPress=1.2.1

WordPress=2.1.3

WordPress=1.2-rc1

WordPress=2.8

WordPress=2.0.7

WordPress=2.1.2

WordPress=2.7.1

WordPress=0.71

WordPress=2.6.3

WordPress=2.2.2

WordPress=2.0.9

WordPress=2.8.1

WordPress=2.2.1

WordPress=1.5.2

WordPress=1.0.1-rc1

WordPress=0.72

WordPress=2.6.2

WordPress=2.3.1

WordPress=2.5.1

WordPress=2.0.3

WordPress=2.6.1

WordPress=0.72-rc1

WordPress=1.2

WordPress=2.3-beta3

WordPress=2.5

WordPress=1.2.2

WordPress=2.0.10

WordPress=1.0

WordPress=1.5

WordPress=2.8.2

WordPress=1.5.1

WordPress=1.5.1.3

WordPress=2.3-rc1

WordPress=2.3.2

WordPress=2.6

WordPress=2.3

WordPress=2.1.1-dangerous

WordPress=0.72-beta_1

WordPress=0.72-beta_2

WordPress=0.71-beta

WordPress=0.71-beta_3

WordPress=1.0.1-miles

WordPress=2.0.5-ronan

WordPress=2.1-ella

WordPress=2.7-coltrane

Remediation

Patch Available

http://wordpress.org/development/2009/08/wordpress-2-8-3-security-release/

Event History

Aug 18, 2009

CVE Published

via MITRE·08:41 PM

Data Sourced

via MITRE·08:41 PM

Description

Frequently Asked Questions

What is the severity of CVE-2009-2853?

CVE-2009-2853 is considered a high severity vulnerability as it allows remote attackers to gain privileges.

How do I fix CVE-2009-2853?

To fix CVE-2009-2853, it is recommended to upgrade to WordPress version 2.8.3 or later.

Which versions of WordPress are affected by CVE-2009-2853?

CVE-2009-2853 affects multiple versions of WordPress prior to 2.8.3 including releases from 0.71 to 2.8.2.

What types of requests can expose the vulnerability in CVE-2009-2853?

CVE-2009-2853 can be exploited through direct requests to specific scripts such as admin-footer.php and edit-category-form.php.

Are there known exploits for CVE-2009-2853?

Yes, there are known exploits for CVE-2009-2853 that could allow attackers to change user roles and gain unauthorized access.