CSRF in Wordpress
CVE-2007-4893
wp-admin/admin-functions.php in Wordpress before 2.2.3 and Wordpress multi-user (MU) before 1.2.5a does not properly verify the unfiltered_html privilege, which allows remote attackers to conduct cross-site scripting (XSS) attacks via modified data to (1) post.php or (2) page.php with a no_filter field.
Vulnerability class: CSRF (Cross-Site Request Forgery)
EPSS: 0.015 (72.0th percentile) — read the EPSS interpretation.
Affected products
- Wordpress — versions 0.6.2, 0.6.2.1, 0.7
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (x_refsource_CONFIRM)
- cve@mitre.org (vdb-entry, x_refsource_VUPEN)
- cve@mitre.org (vendor-advisory, x_refsource_FEDORA)
- cve@mitre.org (vdb-entry, x_refsource_XF)
- cve@mitre.org (x_refsource_CONFIRM)
- cve@mitre.org (x_refsource_SECUNIA, Vendor Advisory, third-party-advisory)
- cve@mitre.org (vdb-entry, x_refsource_BID)
- cve@mitre.org (x_refsource_MISC)
- cve@mitre.org (x_refsource_SECUNIA, third-party-advisory)
Frequently asked questions
- What is CVE-2007-4893?
- CVE-2007-4893 is a vulnerability in Wordpress, classified under Cross-Site Request Forgery (CSRF). Published 2007-09-14.
- Is CVE-2007-4893 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.