CVE-2009-2334

Dashboard / Vulnerabilities / CVE-2009-2334

CVE-2009-2334

Published: 10 Jul 2009Last Modified: 10 Apr 2026

Summary:

Details: wp-admin/admin.php in WordPress and WordPress MU before 2.8.1 does not require administrative authentication to access the configuration of a plugin, which allows remote attackers to specify a configuration file in the page parameter to obtain sensitive information or modify this file, as demonstrated by the (1) collapsing-archives/options.txt, (2) akismet/readme.txt, (3) related-ways-to-take-action/options.php, (4) wp-security-scan/securityscan.php, and (5) wp-ids/ids-admin.php files. NOTE: this can be leveraged for cross-site scripting (XSS) and denial of service.

References: http://wordpress.org/development/2009/07/wordpress-2-8-1/, http://www.debian.org/security/2009/dsa-1871, http://www.vupen.com/english/advisories/2009/1833, http://corelabs.coresecurity.com/index.php?action=view&type=advisory&name=WordPress_Privileges_Unchecked, http://www.osvdb.org/55712, http://www.securityfocus.com/bid/35584, http://www.osvdb.org/55712, http://www.osvdb.org/55715, http://www.securityfocus.com/bid/35584, http://www.vupen.com/english/advisories/2009/1833, http://securitytracker.com/id?1022528, http://www.exploit-db.com/exploits/9110, http://www.securityfocus.com/archive/1/504795/100/0/threaded, https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00597.html, https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00608.html, https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00632.html, https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00676.html

Affected packages

Common Vulnerability Scoring System

Attack Vector

Network

Adjacent

Local

Physical

Privileges Required

None

Low

High

User Interaction

None

Required

Scope

Unchanged

Changed

Confidentiality

None

Low

High

Integrity

None

Low

High

Availability

None

Low

High