CVE-2011-3128

Published: Aug 10, 2011Modified: Apr 29, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 treats unattached attachments as published, which might allow remote attackers to obtain sensitive data via vectors related to wp-includes/post.php.

Affected (4)

Products: Wordpress: Wordpress

Wordpress

1 product

Wordpress

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Wordpress Wordpress	Version 3.1.1
Wordpress Wordpress	Version 3.1.2
Wordpress Wordpress	Version 3.1
Wordpress Wordpress	Version 3.2 beta1

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (12)

http://core.trac.wordpress.org/changeset/18023/branches/3.1

Source: cve@mitre.org

Patch

http://secunia.com/advisories/49138

Source: cve@mitre.org

http://wordpress.org/news/2011/05/wordpress-3-1-3/

Source: cve@mitre.org

Patch

http://www.debian.org/security/2012/dsa-2470

Source: cve@mitre.org

http://www.securityfocus.com/bid/47995

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/69171

Source: cve@mitre.org

http://core.trac.wordpress.org/changeset/18023/branches/3.1