1. Gentoo Linux Security Advisory
| Advisory Reference | GLSA 200608-19 / wordpress |
| Release Date | August 10, 2006 |
| Latest Revision | December 13, 2006: 02 |
| Impact | normal |
| Exploitable | remote |
| Package | Vulnerable versions | Unaffected versions | Architecture(s) |
| www-apps/wordpress | < 2.0.4 | >= 2.0.4 | All supported architectures |
Related bugreports: #142142
A flaw in WordPress allows registered WordPress users to elevate privileges.
WordPress is a PHP and MySQL based multiuser blogging system.
The WordPress developers have confirmed a vulnerability in capability checking for plugins.
By exploiting a flaw, a user can circumvent WordPress access restrictions when using plugins. The actual impact depends on the configuration of WordPress and may range from trivial to critical, possibly even the execution of arbitrary PHP code.
There is no known workaround at this time.
All WordPress users should upgrade to the latest version:
Code Listing 3.1: Resolution |
# emerge --sync # emerge --ask --oneshot --verbose ">=www-apps/wordpress-2.0.4" |