Wordpress before 2.8.3 does not check capabilities for certain actions, which allows remote attackers to make unauthorized edits or additions via a direct request to (1) edit-comments.php, (2) edit-pages.php, (3) edit.php, (4) edit-category-form.php, (5) edit-link-category-form.php, (6) edit-tag-form.php, (7) export.php, (8) import.php, or (9) link-add.php in wp-admin/.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Wordpress | Wordpress | * | 2.8.2 (including) |
| Wordpress | Ubuntu | dapper | * |
| Wordpress | Ubuntu | hardy | * |
| Wordpress | Ubuntu | intrepid | * |
| Wordpress | Ubuntu | jaunty | * |
| Wordpress | Ubuntu | upstream | * |