CVE-2009-2335

This advisory details multiple vulnerabilities in WordPress, including privilege escalation via unchecked access to plugin configuration pages and information disclosure. It provides technical analysis of the root cause and proof-of-concept URLs demonstrating the flaws.

This Metasploit auxiliary module exploits CVE-2009-2335 to enumerate WordPress usernames and perform brute-force authentication attacks. It includes a bypass for the Block-Spam-By-Math-Reloaded plugin.

This Metasploit module performs WordPress user enumeration, validation, and brute-force authentication. It leverages WordPress-specific HTTP requests to check for valid usernames and attempt login with provided credentials.