Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.5
CVE-2006-6016: WordPress admin page lets logged‑in users view other users' data
CVE-2006-6016 · published 19 years ago
Summary
In WordPress versions before 2.0.5, a logged‑in user could change the user_id value in the admin edit page and see another user's profile information. This could expose personal details of any account. Upgrade WordPress to version 2.0.5 or later to close the issue.
What to do
- Update debian wordpress to version 2.0.5-0.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | wordpress |
< 2.0.5-0.1 Fix: upgrade to 2.0.5-0.1
|
| Debian:13 | debian | wordpress |
< 2.0.5-0.1 Fix: upgrade to 2.0.5-0.1
|
| Debian:14 | debian | wordpress |
< 2.0.5-0.1 Fix: upgrade to 2.0.5-0.1
|
| – | wordpress | wordpress |
<= 2.0.4 cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:* |
Original advisory text
wp-admin/user-edit.php in WordPress before 2.0.5 allows remote authenticated users to read the metadata of an arbitrary user via a modified user_id parameter.
wp-admin/user-edit.php in WordPress before 2.0.5 allows remote authenticated users to read the metadata of an arbitrary user via a modified user_id parameter.
References
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
6.5
Medium
Type
CWE-125Out-of-bounds Read
Timeline
Published21 Nov 2006
Updated3 Nov 2026
First seen12 Sep 2026
Track software like this
Free during beta