Re: Wordpress Malicious File Execution Vulnerability
- From: otto@xxxxxxxxxxxxxxxx
- Date: 23 Jul 2008 19:44:51 -0000
Regarding this report of May 2008:
The report is invalid. This is not a vulnerability or a security flaw. Quite frankly, I think it's a joke.
The report itself states: "You must login into wordpress with Administrator Roles". If you have logged into WordPress with Admin roles, then you are the blog owner or administrator. The fact that you can then upload any sort of file you want is a feature, not a bug. The admin has unlimited rights to the site, because he is the admin. Obviously.
Suggest this be marked as invalid everywhere it's been incorrectly marked as valid.
- Prev by Date: [SECURITY] [DSA 1615-1] New xulrunner packages fix several vulnerabilities
- Next by Date: [ MDVSA-2008:153 ] - Updated emacs packages fix vulnerability
- Previous by thread: [SECURITY] [DSA 1615-1] New xulrunner packages fix several vulnerabilities
- Next by thread: [ MDVSA-2008:153 ] - Updated emacs packages fix vulnerability