Permissions, Privileges, and Access Controls in WordPress - CVE-2010-5297
Published: January 21, 2014 / Updated: August 10, 2020
Vulnerability identifier: #VU42131
CSH Severity: Low
CVSS v4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2010-5297
CWE-ID: CWE-264
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote #AU# to manipulate data.
WordPress before 3.0.1, when a Multisite installation is used, permanently retains the "site administrators can add users" option once changed, which might allow remote authenticated administrators to bypass intended access restrictions in opportunistic circumstances via an add action after a temporary change.
Affected software
WordPress
How to mitigate CVE-2010-5297
Install update from vendor's website.