CVE-2010-0682
WordPress 2.9 - Authenticated Information Disclosure via Trash Post Access
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2010-0682. PoCs published by tmacuk.
AI-analyzed exploit summary This PoC exploits a failure to restrict URL access in WordPress >= 2.9, allowing authenticated users with minimal privileges (e.g., 'subscriber') to access trashed posts. The script iterates through post IDs, comparing responses between authenticated and unauthenticated requests to identify trashed posts.
Description
WordPress 2.9 before 2.9.2 allows remote authenticated users to read trash posts from other authors via a direct request with a modified p parameter.
Exploits (1)
This PoC exploits a failure to restrict URL access in WordPress >= 2.9, allowing authenticated users with minimal privileges (e.g., 'subscriber') to access trashed posts. The script iterates through post IDs, comparing responses between authenticated and unauthenticated requests to identify trashed posts.