What is CVE-2009-2334?

CVE-2009-2334 is a vulnerability in WordPress, classified under Improper Authentication. Published 2009-07-10.

Is CVE-2009-2334 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Auth bypass in WordPress

CVE-2009-2334

wp-admin/admin.php in WordPress and WordPress MU before 2.8.1 does not require administrative authentication to access the configuration of a plugin, which allows remote attackers to specify a configuration file in the page parameter to obtain sensitive information or modify this file, as demonstrated by the (1) collapsing-archives/options.txt, (2) akismet/readme.txt, (3) related-ways-to-take-action/options.php, (4) wp-security-scan/securityscan.php, and (5) wp-ids/ids-admin.php files. NOTE: this can be leveraged for cross-site scripting (XSS) and denial of service.

Vulnerability class: Broken Authentication

Published 2009-07-10 · last modified 2026-06-16.

CVSS v2 metric

CVSS v2 base score 4.9 (Medium). Vector: AV:N/AC:M/Au:S/C:P/I:P/A:N. This CVE predates CVSS v3 and has no v3 score from NVD.

EPSS exploit prediction

EPSS: 0.063 (93.3th percentile), scored 2026-09-29.

Low probability of exploitation in the next 30 days, but still tracked. 93rd percentile — 93.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.063 · newest: 0.063 · change: 0.000

Affected products

WordPress — versions 0.6.2, 0.6.2.1, 0.7
WordPress Mu — versions 1.1, 1.1.1, 1.2

Weakness classification (CWE)

CWE-287 — Improper Authentication

Public proof-of-concept exploits

20142995/nuclei-templates

References

www.redhat.com/archives/fedora-package-announce/2009-August/msg00608.html (vendor-advisory)
corelabs.coresecurity.com/index.php (Exploit)
www.redhat.com/archives/fedora-package-announce/2009-July/msg00676.html (vendor-advisory)
wordpress.org/development/2009/07/wordpress-2-8-1/ (Vendor Advisory)
www.securityfocus.com/archive/1/504795/100/0/threaded (mailing-list)
securitytracker.com/id (vdb-entry)
www.redhat.com/archives/fedora-package-announce/2009-July/msg00632.html (vendor-advisory)
www.vupen.com/english/advisories/2009/1833 (Patch, vdb-entry, Vendor Advisory)
www.debian.org/security/2009/dsa-1871 (vendor-advisory)
www.redhat.com/archives/fedora-package-announce/2009-August/msg00597.html (vendor-advisory)

Frequently asked questions

What is CVE-2009-2334?: CVE-2009-2334 is a vulnerability in WordPress, classified under Improper Authentication. Published 2009-07-10.
Is CVE-2009-2334 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.