Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.0
CVE-2008-5113: WordPress on Debian can be tricked into unwanted actions
CVE-2008-5113 · published 17 years ago
Summary
The WordPress version provided by Debian can be fooled by specially crafted cookies, allowing an attacker to delete user accounts or make the site inaccessible. This happens because the software uses a broad data source in risky situations. Update WordPress to a newer version or apply the recommended patches to stop the exploit.
What to do
- Update debian wordpress to version 2.5.1-10.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | wordpress |
< 2.5.1-10 Fix: upgrade to 2.5.1-10
|
| Debian:13 | debian | wordpress |
< 2.5.1-10 Fix: upgrade to 2.5.1-10
|
| Debian:14 | debian | wordpress |
< 2.5.1-10 Fix: upgrade to 2.5.1-10
|
| – | wordpress | wordpress |
2.6.3 cpe:2.3:a:wordpress:wordpress:2.6.3:*:*:*:*:*:*:* |
Original advisory text
WordPress 2.6.3 relies on the REQUEST superglobal array in certain dangerous situations, which makes it easier for remote attackers to conduct delayed and persistent cross-site request forgery (CSR...
WordPress 2.6.3 relies on the REQUEST superglobal array in certain dangerous situations, which makes it easier for remote attackers to conduct delayed and persistent cross-site request forgery (CSRF) attacks via crafted cookies, as demonstrated by attacks that (1) delete user accounts or (2) cause a denial of service (loss of application access). NOTE: this issue relies on the presence of an independent vulnerability that allows cookie injection.
Severity
4.0
Medium
Type
CWE-352Cross-Site Request Forgery (CSRF)
Timeline
Published17 Nov 2008
Updated4 Nov 2026
First seen20 Sep 2026
Track software like this
Free during beta