CVE-2010-5296

Publication date 21 January 2014

Last updated 24 July 2024

Ubuntu priority

Description

wp-includes/capabilities.php in WordPress before 3.0.2, when a Multisite configuration is used, does not require the Super Admin role for the delete_users capability, which allows remote authenticated administrators to bypass intended access restrictions via a delete action.

Status

Show unmaintained releases

Package	Ubuntu Release	Status
wordpress	13.10 saucy	Not affected
	13.04 raring	Not affected
	12.10 quantal	Not affected
	12.04 LTS precise	Not affected
	10.04 LTS lucid	Ignored end of life

How can I get the fixes?
What do statuses mean?

References

MITRE
NVD
Launchpad
Debian

Other references

https://core.trac.wordpress.org/changeset/15562
http://codex.wordpress.org/Version_3.0.2
https://www.cve.org/CVERecord?id=CVE-2010-5296

CVE-2010-5296

Description

Status

References

Other references

Access our resources on patching vulnerabilities