Re: Wordpress Malicious File Execution Vulnerability
Regarding this report of May 2008:
http://www.securityfocus.com/bid/29276
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2392
The report is invalid. This is not a vulnerability or a security flaw. Quite
frankly, I think it's a joke.
The report itself states: "You must login into wordpress with Administrator
Roles". If you have logged into WordPress with Admin roles, then you are the
blog owner or administrator. The fact that you can then upload any sort of file
you want is a feature, not a bug. The admin has unlimited rights to the site,
because he is the admin. Obviously.
Suggest this be marked as invalid everywhere it's been incorrectly marked as
valid.