Access Control

Every one of the 42 is a mark on the map. Named now: 1 to 26, most at risk first.

1. WordPress 2.9 before 2.9.2 allows remote authenticated users to read trash posts from other authors via a direct request with a modified p parameter.CVE-2010-0682Wordpress · 10% likely

   CWE-264

2. Unrestricted file upload vulnerability in html/Upload.php in the FCChat Widget plugin 2.2.13.1 and earlier for WordPress allows remote attackers to execute arbitrary code by uploa…CVE-2012-3578Wordpress · 8.3% likely

   CWE-264

3. WordPress before 4.2.3 does not properly verify the edit_posts capability, which allows remote authenticated users to bypass intended access restrictions and create drafts by leve…CVE-2015-5623Wordpress · 7.7% likely

   CWE-284

4. The mw_editPost function in wp-includes/class-wp-xmlrpc-server.php in the XMLRPC subsystem in WordPress before 4.3.1 allows remote authenticated users to bypass intended access re…CVE-2015-5715Wordpress · 6.4% likely

   CWE-264

5. Peter's Math Anti-Spam Spinoff plugin for WordPress generates audio CAPTCHA clips by concatenating static audio files without any additional distortion, which allows remote attack…CVE-2008-7216Wordpress · 5.8% likely

   CWE-264

6. wp-includes/class-wp-xmlrpc-server.php in WordPress before 5.5.2 allows attackers to gain privileges by using XML-RPC to comment on a post.CVE-2020-28036Wordpress · 5.2% likely

   CWE-862

7. Wordpress before 2.8.3 allows remote attackers to gain privileges via a direct request to (1) admin-footer.php, (2) edit-category-form.php, (3) edit-form-advanced.php, (4) edit-fo…CVE-2009-2853Wordpress · 4.7% likely

   CWE-264

8. The XML-RPC implementation (xmlrpc.php) in WordPress before 2.3.3, when registration is enabled, allows remote attackers to edit posts of other blog users via unknown vectors.CVE-2008-0664Wordpress · 3.6% likely

   CWE-264

9. Plupload before 1.5.4, as used in wp-includes/js/plupload/ in WordPress before 3.3.2 and other products, enables scripting regardless of the domain from which the SWF content was…CVE-2012-2401Wordpress · 3.5% likely

   CWE-264

10. In WordPress before 4.9.9 and 5.x before 5.0.1, authors could modify metadata to bypass intended restrictions on deleting files.CVE-2018-20147Wordpress · 3.1% likely

    CWE-863

11. The map_meta_cap function in wp-includes/capabilities.php in WordPress 3.4.x before 3.4.2, when the multisite feature is enabled, does not properly assign the unfiltered_html capa…CVE-2012-3383Wordpress · 3.1% likely

    CWE-264

12. WordPress and WordPress MU before 2.8.1 allow remote attackers to obtain sensitive information via a direct request to wp-settings.php, which reveals the installation path in an e…CVE-2009-2432Wordpress · 3.1% likely

    CWE-264

13. In WordPress before 4.7.3 (wp-admin/plugins.php), unintended files can be deleted by administrators using the plugin deletion functionality.CVE-2017-6816Wordpress · 3.0% likely

    CWE-863

14. The HTTP API in WordPress before 3.5.2 allows remote attackers to send HTTP requests to intranet servers via unspecified vectors, related to a Server-Side Request Forgery (SSRF) i…CVE-2013-2199Wordpress · 2.8% likely

    CWE-264

15. wp-includes/vars.php in Wordpress before 2.2.3 does not properly extract the current path from the PATH_INFO ($PHP_SELF), which allows remote attackers to bypass intended access r…CVE-2008-2146Wordpress · 2.7% likely

    CWE-264

16. wp-admin/includes/post.php in WordPress before 3.6.1 allows remote authenticated users to spoof the authorship of a post by leveraging the Author role and providing a modified use…CVE-2013-4340Wordpress · 2.7% likely

    CWE-264

17. wp-admin/plugins.php in WordPress before 3.3.2 allows remote authenticated site administrators to bypass intended access restrictions and deactivate network-wide plugins via unspe…CVE-2012-2402Wordpress · 2.7% likely

    CWE-264

18. WordPress allows remote attackers to determine the existence of arbitrary files, and possibly read portions of certain files, via pingback service calls with a source URI that cor…CVE-2007-0541Wordpress · 2.7% likely

    CWE-264

19. The (1) get_edit_post_link and (2) get_edit_comment_link functions in wp-includes/link-template.php in WordPress before 2.6.1 do not force SSL communication in the intended situat…CVE-2008-3747Wordpress · 2.5% likely

    CWE-264

20. wp-includes/comment.php in WordPress before 3.0.2 does not properly whitelist trackbacks and pingbacks in the blogroll, which allows remote attackers to bypass intended spam restr…CVE-2010-5293Wordpress · 2.5% likely

    CWE-264

21. In in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in WordPress 3.7 to 5.3.0, authenticated users who do not have the rights to publish a post are able to mar…CVE-2019-20043Wordpress · 2.5% likely

    CWE-269

22. WordPress before 3.7.2 and 3.8.x before 3.8.2 allows remote authenticated users to publish posts by leveraging the Contributor role, related to wp-admin/includes/post.php and wp-a…CVE-2014-0165Wordpress · 2.4% likely

    CWE-264

23. Unauthenticated disclosure of certain private posts in WordPressCVE-2020-11028WordPress · CVSS 5.8 · 2.3% likely

    CWE-284

24. Wordpress before 2.8.3 does not check capabilities for certain actions, which allows remote attackers to make unauthorized edits or additions via a direct request to (1) edit-comm…CVE-2009-2854Wordpress · 2.3% likely

    CWE-264

25. WordPress before 3.0.1, when a Multisite installation is used, permanently retains the "site administrators can add users" option once changed, which might allow remote authentica…CVE-2010-5297Wordpress · 2.2% likely

    CWE-264

26. The XML-RPC remote publishing interface in xmlrpc.php in WordPress before 3.0.3 does not properly check capabilities, which allows remote authenticated users to bypass intended ac…CVE-2010-5106Wordpress · 2.2% likely

    CWE-264

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.