Description
WordPress 2.6.3 relies on the REQUEST superglobal array in certain dangerous situations, which makes it easier for remote attackers to conduct delayed and persistent cross-site request forgery (CSRF) attacks via crafted cookies, as demonstrated by attacks that (1) delete user accounts or (2) cause a denial of service (loss of application access). NOTE: this issue relies on the presence of an independent vulnerability that allows cookie injection.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | wordpress | 2.5.1-10 | — |
| Debian 13 | wordpress | 2.5.1-10 | — |
| Debian 12 | wordpress | 2.5.1-10 | — |
| Debian 5.0 | wordpress | 2.5.1-11+lenny1 | DSA-1871-1 |
| Debian 4.0 | wordpress | 2.0.10-1etch4 | DSA-1871-2, DSA-1871-1 |
Advisories 2
- DSA-1871-2 wordpress - regression fix Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1871-1 wordpress - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- DSA-1871 vendor-advisory
- http://bugs.debian.org/504771
- wordpress-request-weak-security(46698) vdb-entry
- [oss-security] 20081113 CVE request: wordpress can be subject of delayed attacks via cookies mailing-list