CVE-2010-5296

wp-includes/capabilities.php in WordPress before 3.0.2, when a Multisite configuration is used, does not require the Super Admin role for the delete_users capability, which allows remote authenticated administrators to bypass intended access restrictions via a delete action.

CVSS v2.0

4.9 MEDIUMAV:N/AC:M/Au:S/C:P/I:P/A:N

EPSS

1.69% chance of exploitation in the next 30 days, 76th percentile

Nuclei

low

Published

2014-01-21

Updated

2024-09-17

Nuclei templates (1)

• topscoder/nuclei-wordfence-cve/blob/main/nuclei-templates/2010/CVE-2010-5296-wordpress-a1…

References

• CVE Record
• NVD entry

Related

• CVE-2010-5295
• CVE-2010-5297
• CVE-2010-5294
• CVE-2010-5299
• CVE-2010-5293
• CVE-2010-5300