CVE-2009-2336
WordPress and WordPress MU < 2.8.1 - Username Enumeration via Forgotten Mail Interface
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2009-2336. PoCs published by Core Security.
AI-analyzed exploit summary This advisory details multiple vulnerabilities in WordPress, including privilege escalation via unchecked access to plugin configuration pages and information disclosure. It provides technical analysis of the root cause and proof-of-concept URLs demonstrating the flaws.
Description
The forgotten mail interface in WordPress and WordPress MU before 2.8.1 exhibits different behavior for a password request depending on whether the user account exists, which allows remote attackers to enumerate valid usernames. NOTE: the vendor reportedly disputes the significance of this issue, indicating that the behavior exists for "user convenience."
Exploits (1)
This advisory details multiple vulnerabilities in WordPress, including privilege escalation via unchecked access to plugin configuration pages and information disclosure. It provides technical analysis of the root cause and proof-of-concept URLs demonstrating the flaws.