CVE-2010-5296

wp-includes/capabilities.php in WordPress before 3.0.2, when a Multisite configuration is used, does not require the Super Admin role for the delete_users capability, which allows remote authenticated administrators to bypass intended access restrictions via a delete action.

Score

CVSS 2.0 4.9 Medium

Status

Modified - cve@mitre.org

Published

2014-01-21

Last modified

2024-09-17

Weaknesses

CWE-264

Affected products

• Wordpress (Wordpress)

References

• http://codex.wordpress.org/Version_3.0.2
• https://core.trac.wordpress.org/changeset/15562