CVE-2015-5623
EPSS 48.4%Published: 8/3/2015Modified: 5/27/2026
Also known as:DEBIAN-CVE-2015-5623
Description
WordPress before 4.2.3 does not properly verify the edit_posts capability, which allows remote authenticated users to bypass intended access restrictions and create drafts by leveraging the Subscriber role, as demonstrated by a post-quickdraft-save action to wp-admin/post.php.
Affected packages (1)
- Debian/wordpressfrom 0, < 4.2.3+dfsg-1