PoC Index

CVE-2015-5623

MEDIUM 4.0EPSS 7.5%

WordPress before 4.2.3 does not properly verify the edit_posts capability, which allows remote authenticated users to bypass intended access restrictions and create drafts by leveraging the Subscriber role, as demonstrated by a post-quickdraft-save action to wp-admin/post.php.

CVSS v2.0
4.0 MEDIUMAV:N/AC:L/Au:S/C:N/I:P/A:N
EPSS
7.48% chance of exploitation in the next 30 days, 94th percentile
Nuclei
low
Published
2015-08-03
Updated
2024-08-06

Proof-of-concept exploits (1)

Nuclei templates (1)

References

Related