Description
WordPress and WordPress MU before 2.8.1 allow remote attackers to obtain sensitive information via a direct request to wp-settings.php, which reveals the installation path in an error message.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | wordpress | 2.8.3-1 | — |
| Debian 13 | wordpress | 2.8.3-1 | — |
| Debian 12 | wordpress | 2.8.3-1 | — |
References
- http://corelabs.coresecurity.com/index.php?action=view&type=advisory&name=WordPress_Privileges_Unchecked
- 20090708 CORE-2009-01515 - WordPress Privileges Unchecked in admin.php and Multiple Information mailing-list
- 1022528 vdb-entry
- ADV-2009-1833 vdb-entry
- wordpress-wpsettings-path-disclosure(51734) vdb-entry
- 55717 vdb-entry