CVE
- Id
- 47880
- CVE No.
- CVE-2010-5296
- Status
- Candidate
- Description
- wp-includes/capabilities.php in WordPress before 3.0.2, when a Multisite configuration is used, does not require the Super Admin role for the delete_users capability, which allows remote authenticated administrators to bypass intended access restrictions via a delete action.
- Phase
- Assigned (20140120)
- Votes
- None (candidate not yet proposed)
- Comments