Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
2.1

WordPress Multisite: Unintended User Access

CVE-2010-5297 · published 12 years ago
Summary

This issue affects WordPress Multisite installations before version 3.0.1. If a site administrator changes the option to allow site administrators to add users, it will stay that way even after changing it back. This could potentially allow an attacker to add users to a site if they have access to the site's administration area.

What to do
  • Update debian wordpress to version 3.0.1-1.
Affected software
Ecosystem VendorProductAffected versions
Debian:11 debian wordpress < 3.0.1-1
Fix: upgrade to 3.0.1-1
Debian:12 debian wordpress < 3.0.1-1
Fix: upgrade to 3.0.1-1
Debian:13 debian wordpress < 3.0.1-1
Fix: upgrade to 3.0.1-1
Debian:14 debian wordpress < 3.0.1-1
Fix: upgrade to 3.0.1-1
– wordpress wordpress <= 3.0
2.0
2.0.1
2.0.2
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
2.0.10
2.0.11
34 more version ranges
cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*
Original advisory text
WordPress before 3.0.1, when a Multisite installation is used, permanently retains the "site administrators can add users" option once changed, which might allow remote authenticated administrators...
WordPress before 3.0.1, when a Multisite installation is used, permanently retains the "site administrators can add users" option once changed, which might allow remote authenticated administrators to bypass intended access restrictions in opportunistic circumstances via an add action after a temporary change.
References
Severity
2.1 Low
Exploitation
2% chance of attack within 30 days
Type
CWE-264Permissions, Privileges, and Access Controls
Timeline
Published21 Jan 2014
Updated29 Oct 2026
First seen15 Aug 2026
Sources
DEBIAN-CVE-2010-5297 · OSV
CVE-2010-5297 · NVD
Track software like this
Free during beta