CVE-2015-5715: Medium severity WordPress WordPress vulnerability
Published May 22, 2016
·Updated
The mweditPost function in wp-includes/class-wp-xmlrpc-server.php in the XMLRPC subsystem in WordPress before 4.3.1 allows remote authenticated users to bypass intended access restrictions, and arrange for a private post to be published and sticky, via unspecified vectors.
Affected Software
2 affected componentsFixes available
WordPress WordPress<=4.3.0
debian/wordpress
5.7.11+dfsg1-0+deb11u15.7.14+dfsg1-0+deb11u16.1.9+dfsg1-0+deb12u16.8.3+dfsg1-0+deb13u16.9+dfsg1-1
Remediation
Patch Available
Patch Available
Event History
May 22, 2016
CVE Published
via MITRE·01:00 AM
Data Sourced
via MITRE·01:00 AM
Description
Feb 18, 2026
Data Sourced
via Debian·11:08 PM
DescriptionAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2015-5715?
CVE-2015-5715 has a medium severity rating that allows remote authenticated users to bypass access restrictions.
2
How do I fix CVE-2015-5715?
To fix CVE-2015-5715, update WordPress to version 4.3.1 or later.
3
Who is affected by CVE-2015-5715?
Any version of WordPress prior to 4.3.1 is affected by CVE-2015-5715.
4
What does CVE-2015-5715 exploit?
CVE-2015-5715 exploits the mw_editPost function in the XMLRPC subsystem of WordPress.
5
Can CVE-2015-5715 lead to further vulnerabilities?
Yes, CVE-2015-5715 can potentially allow unauthorized publication and sticky status for private posts.