WordPress Vulnerabilities

WordPress 2.0 - 3.0.1 wp-includes/capabilities.php Remote Authenticated Administrator Delete Action Bypass

Affects WordPress

3.0.1
Fixed in WordPress 3.0.2
3.0
Fixed in WordPress 3.0.2
2.9.2
Fixed in WordPress 3.0.2
2.9.1
Fixed in WordPress 3.0.2
2.9
Fixed in WordPress 3.0.2
2.8.6
Fixed in WordPress 3.0.2
2.8.5
Fixed in WordPress 3.0.2
2.8.4
Fixed in WordPress 3.0.2
2.8.3
Fixed in WordPress 3.0.2
2.8.2
Fixed in WordPress 3.0.2
2.8.1
Fixed in WordPress 3.0.2
2.8
Fixed in WordPress 3.0.2
2.7.1
Fixed in WordPress 3.0.2
2.7
Fixed in WordPress 3.0.2
2.6.5
Fixed in WordPress 3.0.2
2.6.3
Fixed in WordPress 3.0.2
2.6.2
Fixed in WordPress 3.0.2
2.6.1
Fixed in WordPress 3.0.2
2.6
Fixed in WordPress 3.0.2
2.5.1
Fixed in WordPress 3.0.2
2.5
Fixed in WordPress 3.0.2
2.3.3
Fixed in WordPress 3.0.2
2.3.2
Fixed in WordPress 3.0.2
2.3.1
Fixed in WordPress 3.0.2
2.3
Fixed in WordPress 3.0.2
2.2.3
Fixed in WordPress 3.0.2
2.2.2
Fixed in WordPress 3.0.2
2.2.1
Fixed in WordPress 3.0.2
2.2
Fixed in WordPress 3.0.2
2.1.3
Fixed in WordPress 3.0.2
2.1.2
Fixed in WordPress 3.0.2
2.1.1
Fixed in WordPress 3.0.2
2.1
Fixed in WordPress 3.0.2
2.0.11
Fixed in WordPress 3.0.2
2.0.10
Fixed in WordPress 3.0.2
2.0.9
Fixed in WordPress 3.0.2
2.0.8
Fixed in WordPress 3.0.2
2.0.7
Fixed in WordPress 3.0.2
2.0.6
Fixed in WordPress 3.0.2
2.0.5
Fixed in WordPress 3.0.2
2.0.4
Fixed in WordPress 3.0.2
2.0.3
Fixed in WordPress 3.0.2
2.0.2
Fixed in WordPress 3.0.2
2.0.1
Fixed in WordPress 3.0.2
2.0
Fixed in WordPress 3.0.2

References

CVE
CVE-2010-5296

Classification

Type
AUTHBYPASS
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-287

Miscellaneous

Verified
No
WPVDB ID
23d50511-6d14-4be0-956b-e0da30044188

Timeline

Publicly Published
2014-08-01 (about 11 years ago)
Added
2014-08-01 (about 11 years ago)
Last Updated
2019-10-21 (about 6 years ago)

Other

Published
Title
Published
2026-03-17
Title
KiviCare – Clinic & Patient Management System (EHR) < 4.1.3 - Unauthenticated Authentication Bypass via Social Login Token
Published
2019-05-28
Title
Slick Popup <= 1.7.1 - Privilege Escalation
Published
2025-06-11
Title
Workreap < 3.3.2 - Authentication Bypass via 'workreap_verify_user_account'
Published
2024-06-12
Title
Download Manager < 3.2.90 - Improper Authorization via protectMediaLibrary
Published
2025-02-06
Title
Nextend Social Login Pro < 3.1.17 - Authentication Bypass via Apple OAuth provider