First published: Fri Aug 29 2014(Updated: )
The WordPress Mobile Pack plugin before 2.0.2 for WordPress does not properly restrict access to password protected posts, which allows remote attackers to obtain sensitive information via an exportarticles action to export/content.php.
Credit: cve@mitre.org
Affected Software | Affected Version | How to fix |
---|---|---|
WordPress | <=2.0.1 | |
WordPress | =1.2.0 | |
WordPress | =1.2.0-b | |
WordPress | =1.2.0-b2 | |
Wpmobilepack Wordpress Mobile Pack | =1.0.8223 | |
Wpmobilepack Wordpress Mobile Pack | =1.1.1 | |
Wpmobilepack Wordpress Mobile Pack | =1.1.2 | |
Wpmobilepack Wordpress Mobile Pack | =1.1.3 | |
Wpmobilepack Wordpress Mobile Pack | =1.1.9 | |
Wpmobilepack Wordpress Mobile Pack | =1.1.91 | |
Wpmobilepack Wordpress Mobile Pack | =1.1.92 | |
Wpmobilepack Wordpress Mobile Pack | =1.2.1 | |
Wpmobilepack Wordpress Mobile Pack | =1.2.3 | |
Wpmobilepack Wordpress Mobile Pack | =1.2.4 | |
Wpmobilepack Wordpress Mobile Pack | =1.2.5 | |
Wpmobilepack Wordpress Mobile Pack | =2.0 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2014-5337 has been classified as a medium severity vulnerability.
To fix CVE-2014-5337, update the WordPress Mobile Pack plugin to version 2.0.2 or later.
CVE-2014-5337 exposes sensitive information from password protected posts.
CVE-2014-5337 affects the WordPress Mobile Pack plugin versions prior to 2.0.2.
Yes, CVE-2014-5337 allows remote attackers to exploit the vulnerability to access sensitive information.