Re: Wordpress - Broken Access Control

The is_admin() function is not supposed to tell whether a user is an administrator or not, it tells whether the user is looking at one of the administration pages. As such, this function does exactly what it is supposed to do.

As for the rest, there is no flaw. To view a draft, the user must authenticate and have the correct capability set. There is no way to view drafts without being logged in and having that capability set on the user's role level.

This "vulnerability" is non-existent.

Relevant Pages

  • Administrator Account - Make Up for Incorrect Practice
    ... (This post is a bit of follow-up to my previous post about deleting folders ... I began using the Administrator account several years ago when I had ... Nor are the non-existent links ...
    (microsoft.public.windowsxp.configuration_manage)
  • Re: Stop emails to non existent users
    ... What happens to the e-mail with the non-existent ... Will the Administrator get undeliverable message for each? ...
    (microsoft.public.exchange.admin)