CVE-2015-5715 - Vulnerability Details - OpenCVE

The mw_editPost function in wp-includes/class-wp-xmlrpc-server.php in the XMLRPC subsystem in WordPress before 4.3.1 allows remote authenticated users to bypass intended access restrictions, and arrange for a private post to be published and sticky, via unspecified vectors.

No CVSS v4.0

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.28517.

Key SSVC decision points have not yet been added.

Vendors	Products
Wordpress	Wordpress

Configuration 1 [-]

cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*

No data.

No data.

Advisories

Source	ID	Title
Debian DLA	DLA-321-1	wordpress security update
Debian DSA	DSA-3375-1	wordpress security update
Debian DSA	DSA-3383-1	wordpress security update

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
http://www.debian.org/security/2015/dsa-3375
http://www.debian.org/security/2015/dsa-3383
http://www.securityfocus.com/bid/76748
http://www.securitytracker.com/id/1033979
https://codex.wordpress.org/Version_4.3.1
https://github.com/WordPress/WordPress/commit/9c57f3a4291f2311ae05f22c10eedeb0f69337ab
https://security-tracker.debian.org/tracker/CVE-2015-5715
https://wordpress.org/news/2015/09/wordpress-4-3-1/
https://wpvulndb.com/vulnerabilities/8188

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2016-05-22T01:00:00

Updated: 2024-08-06T06:59:04.061Z

Reserved: 2015-08-02T00:00:00

Link: CVE-2015-5715

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2016-05-22T01:59:02.617

Modified: 2025-04-12T10:46:40.837

Link: CVE-2015-5715

Redhat

No data.

OpenCVE Enrichment

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2015-09-15T00:00:00", "descriptions": [{"lang": "en", "value": "The mw_editPost function in wp-includes/class-wp-xmlrpc-server.php in the XMLRPC subsystem in WordPress before 4.3.1 allows remote authenticated users to bypass intended access restrictions, and arrange for a private post to be published and sticky, via unspecified vectors."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-11-03T18:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "76748", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/76748"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://security-tracker.debian.org/tracker/CVE-2015-5715"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://codex.wordpress.org/Version_4.3.1"}, {"name": "DSA-3375", "tags": ["vendor-advisory", "x_refsource_DEBIAN"], "url": "http://www.debian.org/security/2015/dsa-3375"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://wordpress.org/news/2015/09/wordpress-4-3-1/"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/WordPress/WordPress/commit/9c57f3a4291f2311ae05f22c10eedeb0f69337ab"}, {"tags": ["x_refsource_MISC"], "url": "https://wpvulndb.com/vulnerabilities/8188"}, {"name": "1033979", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id/1033979"}, {"name": "DSA-3383", "tags": ["vendor-advisory", "x_refsource_DEBIAN"], "url": "http://www.debian.org/security/2015/dsa-3383"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2015-5715", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The mw_editPost function in wp-includes/class-wp-xmlrpc-server.php in the XMLRPC subsystem in WordPress before 4.3.1 allows remote authenticated users to bypass intended access restrictions, and arrange for a private post to be published and sticky, via unspecified vectors."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "76748", "refsource": "BID", "url": "http://www.securityfocus.com/bid/76748"}, {"name": "https://security-tracker.debian.org/tracker/CVE-2015-5715", "refsource": "CONFIRM", "url": "https://security-tracker.debian.org/tracker/CVE-2015-5715"}, {"name": "https://codex.wordpress.org/Version_4.3.1", "refsource": "CONFIRM", "url": "https://codex.wordpress.org/Version_4.3.1"}, {"name": "DSA-3375", "refsource": "DEBIAN", "url": "http://www.debian.org/security/2015/dsa-3375"}, {"name": "https://wordpress.org/news/2015/09/wordpress-4-3-1/", "refsource": "CONFIRM", "url": "https://wordpress.org/news/2015/09/wordpress-4-3-1/"}, {"name": "https://github.com/WordPress/WordPress/commit/9c57f3a4291f2311ae05f22c10eedeb0f69337ab", "refsource": "CONFIRM", "url": "https://github.com/WordPress/WordPress/commit/9c57f3a4291f2311ae05f22c10eedeb0f69337ab"}, {"name": "https://wpvulndb.com/vulnerabilities/8188", "refsource": "MISC", "url": "https://wpvulndb.com/vulnerabilities/8188"}, {"name": "1033979", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id/1033979"}, {"name": "DSA-3383", "refsource": "DEBIAN", "url": "http://www.debian.org/security/2015/dsa-3383"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T06:59:04.061Z"}, "title": "CVE Program Container", "references": [{"name": "76748", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/76748"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://security-tracker.debian.org/tracker/CVE-2015-5715"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://codex.wordpress.org/Version_4.3.1"}, {"name": "DSA-3375", "tags": ["vendor-advisory", "x_refsource_DEBIAN", "x_transferred"], "url": "http://www.debian.org/security/2015/dsa-3375"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://wordpress.org/news/2015/09/wordpress-4-3-1/"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/WordPress/WordPress/commit/9c57f3a4291f2311ae05f22c10eedeb0f69337ab"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://wpvulndb.com/vulnerabilities/8188"}, {"name": "1033979", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://www.securitytracker.com/id/1033979"}, {"name": "DSA-3383", "tags": ["vendor-advisory", "x_refsource_DEBIAN", "x_transferred"], "url": "http://www.debian.org/security/2015/dsa-3383"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2015-5715", "datePublished": "2016-05-22T01:00:00", "dateReserved": "2015-08-02T00:00:00", "dateUpdated": "2024-08-06T06:59:04.061Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "matchCriteriaId": "398224EA-459C-49CF-9176-B144CA74A0F2", "versionEndIncluding": "4.3.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The mw_editPost function in wp-includes/class-wp-xmlrpc-server.php in the XMLRPC subsystem in WordPress before 4.3.1 allows remote authenticated users to bypass intended access restrictions, and arrange for a private post to be published and sticky, via unspecified vectors."}, {"lang": "es", "value": "La funci\u00f3n mw_editPost en wp-includes/class-wp-xmlrpc-server.php en el subsistema XMLRPC en WordPress en versiones anteriores a 4.3.1 permite a usuarios remotos autenticados eludir las restricciones destinadas al acceso y disponer para una publicaci\u00f3n privada que sera publicada y adherida, a trav\u00e9s de vectores no especificados."}], "id": "CVE-2015-5715", "lastModified": "2025-04-12T10:46:40.837", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2016-05-22T01:59:02.617", "references": [{"source": "cve@mitre.org", "url": "http://www.debian.org/security/2015/dsa-3375"}, {"source": "cve@mitre.org", "url": "http://www.debian.org/security/2015/dsa-3383"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/bid/76748"}, {"source": "cve@mitre.org", "url": "http://www.securitytracker.com/id/1033979"}, {"source": "cve@mitre.org", "tags": ["Patch", "Vendor Advisory"], "url": "https://codex.wordpress.org/Version_4.3.1"}, {"source": "cve@mitre.org", "tags": ["Patch"], "url": "https://github.com/WordPress/WordPress/commit/9c57f3a4291f2311ae05f22c10eedeb0f69337ab"}, {"source": "cve@mitre.org", "url": "https://security-tracker.debian.org/tracker/CVE-2015-5715"}, {"source": "cve@mitre.org", "tags": ["Patch", "Vendor Advisory"], "url": "https://wordpress.org/news/2015/09/wordpress-4-3-1/"}, {"source": "cve@mitre.org", "url": "https://wpvulndb.com/vulnerabilities/8188"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.debian.org/security/2015/dsa-3375"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.debian.org/security/2015/dsa-3383"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/76748"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securitytracker.com/id/1033979"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "https://codex.wordpress.org/Version_4.3.1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/WordPress/WordPress/commit/9c57f3a4291f2311ae05f22c10eedeb0f69337ab"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://security-tracker.debian.org/tracker/CVE-2015-5715"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "https://wordpress.org/news/2015/09/wordpress-4-3-1/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://wpvulndb.com/vulnerabilities/8188"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-264"}], "source": "nvd@nist.gov", "type": "Primary"}]}