Unauthorized Access Vulnerability in WordPress Admin Configuration

CVE-2009-2334

Summary

A vulnerability exists in the WordPress and WordPress MU platforms where the admin.php file does not enforce administrative authentication to access sensitive plugin configuration settings. This flaw enables remote attackers to manipulate the page parameter, allowing access to files such as options.txt and securityscan.php, potentially leading to the exposure of sensitive information or the modification of critical files within the WordPress installation. Attackers can exploit this vulnerability for purpose of unauthorized actions, including but not limited to, initiating cross-site scripting (XSS) attacks and causing denial of service.

References