# MA-175.072009: MyCERT Alert - Wordpress Privileges Unchecked in admin.php and Multiple Information Disclosures

**Date:** 09 Jul 2009  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-175.072009  
**Advisory ID:** MA-175.072009

---

#### **1.0 Introduction**
Several vulnerabilities have been identified in Wordpress, a free and open source blog publishing application and Content Management System. The vulnerabilities are as the following:
- Wordpress Privileges Unchecked in admin.php
- Local file include
- Privileges unchecked
- Cross site scripting
- Information Disclosure Vulnerabilities
**2.0 Impact**
By exploiting these vulnerabilities, an attacker could potentially obtain sensitive information, execute arbitrary code in the browser of an unsuspecting user in the context of the affected site, or control how the site is rendered to the user. In certain situations, it may also be possible for attacker to execute arbitrary code on the affected server.
**3.0 Affected Products**
Below is the details list of vulnerable version:
- Wordpress 2.8 and earlier version
- Wordpress MU 2.7.1 and earlier version
**4.0 Recommendation**
MyCERT highly recommends that users of this application upgrade to the latest version of Wordpress (currently Wordpress 2.8.1 RC1). The latest version can be obtained via this URL: <http://wordpress.org/download/>
**MyCERT can be reached at:**
E-mail : [[email protected]](/cdn-cgi/l/email-protection#04677d6661763d3d3d44677d66617677616771766d707d2a697d) or [[email protected]](/cdn-cgi/l/email-protection#97faeef4f2e5e3d7faeef4f2e5e3b9f8e5f0b9faee)
Phone : +603 89926969 or 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442
Handphone : +60 19 2665850 (24x7 call incident reporting)
SMS : +60 19 2813801 (24x7 SMS reporting)
Business Hours : Mon - Fri 08:30 -17:30 MYT
Web: [https://www.mycert.org.my](https://www.mycert.org.my/)
**5.0 References**
- <http://corelabs.coresecurity.com/index.php?action=view&type=advisory&name=Wordpress_Privileges_Unchecked>
- <http://www.ybo-interactive.com/blog/2008/03/30/Wordpress-vulnerability/>
- <http://www.securityfocus.com/archive/1/504795>