CVE-2006-6017

WordPress before 2.0.5 does not properly store a profile containing a string representation of a serialized object, which allows remote authenticated users to cause a denial of service (application crash) via a string that represents a (1) malformed or (2) large serialized object, because the object triggers automatic unserialization for display.

CVSS v3.1

6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CVSS v2.0

4.0 MEDIUMAV:N/AC:L/Au:S/C:N/I:N/A:P

EPSS

2.28% chance of exploitation in the next 30 days, 82th percentile

Nuclei

low

Published

2006-11-21

Updated

2025-04-03

Nuclei templates (1)

• topscoder/nuclei-wordfence-cve/blob/main/nuclei-templates/2006/CVE-2006-6017-wordpress-be…

References

• CVE Record
• NVD entry

Related

• CVE-2006-6016
• CVE-2006-6018
• CVE-2006-6015
• CVE-2006-6020
• CVE-2006-6010
• CVE-2006-6021