VULNERABILITY INTELLIGENCE
CVE-2012-4421
CVSS score4 MEDIUM
EPSS probability1.90%
CISA KEVNot currently listed
Published2012-09-14
Last modified2026-06-16
CVSS vectorAV:N/AC:L/Au:S/C:N/I:P/A:N
Description
The create_post function in wp-includes/class-wp-atom-server.php in WordPress before 3.4.2 does not perform a capability check, which allows remote authenticated users to bypass intended access restrictions and publish new posts by leveraging the Contributor role and using the Atom Publishing Protocol (aka AtomPub) feature.