p PatchFirst

CVE-2009-2335

CVE-2009-2335

This page contains facts from public vulnerability sources. Check the original advisory before updating.

WordPress and WordPress MU before 2.8.1 exhibit different behavior for a failed login attempt depending on whether the user account exists, which allows remote attackers to enumerate valid usernames. NOTE: the vendor reportedly disputes the significance of this issue, indicating that the behavior exists for "user convenience."

EPSS 85.0% · Public exploit · Fix available

Published
Updated

Stack: system

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • wordpress Debian:12

    Affected ranges
    • ECOSYSTEM: < 2.8.3-1

    Update to 2.8.3-1

  • wordpress Debian:13

    Affected ranges
    • ECOSYSTEM: < 2.8.3-1

    Update to 2.8.3-1

  • wordpress Debian:14

    Affected ranges
    • ECOSYSTEM: < 2.8.3-1

    Update to 2.8.3-1

Original sources

Check your server →