CVE-2009-2335: wordpress Configuration
Vulnerability summary
CVE-2009-2335 is a medium (CVSS 5.3) Configuration vulnerability in wordpress. EPSS estimates a 85.00% chance of exploitation in the next 30 days, higher than 99.7% of scored vulnerabilities. 4 public exploits are recorded. Fixed in 2.8.1.
Timeline
- 10-07-2009PublishedVulnerability first disclosed.
- 07-08-2024Last modifiedVulnerability information updated.
Description
WordPress and WordPress MU before 2.8.1 exhibit different behavior for a failed login attempt depending on whether the user account exists, which allows remote attackers to enumerate valid usernames. NOTE: the vendor reportedly disputes the significance of this issue, indicating that the behavior exists for "user convenience."
CVSS metrics
2 scores · 2 sources · 2 versionsEPSS trend
Probability
85.00%
Chance of exploitation in the next 30 days
Percentile
100%
Versus all other CVEs
30-day change
0.00 pp
From 85.00% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
4 foundWordPress Core / MU / Plugins - '/admin.php' Privileges Unchecked / Multiple Information Disclosures
Maturity: poc
Exploit Reference (corelabs.coresecurity.com)
Maturity: unknown
WordPress Plugin Block-Spam-By-Math-Reloaded - Bypass
Maturity: poc
Weaknesses
CWE · root cause- CWE-16ConfigurationWeaknesses in this category are typically introduced during the configuration of the software.
- CWE-204Observable Response DiscrepancyThe product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.
Affected systems
Wordpress4 products
- wordpress≤ 2.8 (fixed in 2.8.1)
- wpmu≤ 2.8 (fixed in 2.8.1)
- wordpress< 2.8.1
- wordpress_mu< 2.8.1
Debian1 product
- wordpress< 2.8.3-1
2 vendors · 5 products
References
13 links- www.redhat.com/archives/fedora-package-announce/2009-August/msg00608.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
- corelabs.coresecurity.com/index.php?action=view&type=advisory&name=WordPress_Privileges_UncheckedX Refsource MISCExploitThird Party Advisory
- www.redhat.com/archives/fedora-package-announce/2009-July/msg00676.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
- www.securityfocus.com/archive/1/504795/100/0/threadedMailing ListX Refsource BUGTRAQThird Party AdvisoryVDB Entry
- www.redhat.com/archives/fedora-package-announce/2009-July/msg00632.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
- www.redhat.com/archives/fedora-package-announce/2009-August/msg00597.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
