CVE-2007-4893: wordpress Cross-Site Request Forgery (CSRF)
Vulnerability summary
CVE-2007-4893 is a medium (CVSS 6.4) Cross-Site Request Forgery (CSRF) vulnerability in wordpress. EPSS estimates a 1.52% chance of exploitation in the next 30 days, higher than 74.2% of scored vulnerabilities. Fixed in 2.2.3 and 1.2.5a.
Timeline
- 14-09-2007PublishedVulnerability first disclosed.
- 07-08-2024Last modifiedVulnerability information updated.
Description
wp-admin/admin-functions.php in Wordpress before 2.2.3 and Wordpress multi-user (MU) before 1.2.5a does not properly verify the unfiltered_html privilege, which allows remote attackers to conduct cross-site scripting (XSS) attacks via modified data to (1) post.php or (2) page.php with a no_filter field.
CVSS metrics
2 scores · 2 sources · 2 versionsEPSS trend
Probability
1.52%
Chance of exploitation in the next 30 days
Percentile
74%
Versus all other CVEs
30-day change
0.00 pp
From 1.52% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-352Cross-Site Request Forgery (CSRF)The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
- CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Affected systems
Wordpress3 products
- wordpress≤ 2.2.2 (fixed in 2.2.3)
- wpmu< 1.2.5a
- wordpressEOL0.6.2 | 0.6.2.1 | 0.7 | 0.71 | 1.2 | 1.2.1 | 1.2.2 | 1.5 | 1.5.1 | 1.5.1.2 | 1.5.1.3 | 2.0 | 2.0.1 | 2.0.2 | 2.0.3 | 2.0.4 | 2.0.5 | 2.0.6 | 2.0.7 | 2.0.10_rc1 | 2.0.10_rc2 | 2.1.1 | 2.1.2 | 2.1.3 | 2.1.3_rc1 | 2.1.3_rc2 | 2.2 | 2.2.1 | 2.2.2 | 2.2_revision5002 | 2.2_revision5003
Debian1 product
- wordpress< 2.2.3-1
2 vendors · 4 products
References
11 links- trac.wordpress.org/ticket/4720X Refsource CONFIRM
- wordpress.org/development/2007/09/wordpress-223/X Refsource CONFIRM
- bugzilla.redhat.com/show_bug.cgi?id=285831X Refsource MISC
