CVE-2012-4422

Published Sep 14, 2012 CVSS 2.0 · 3.5 Low EPSS 1.7% KEV · Not listed
Description
wp-admin/plugins.php in WordPress before 3.4.2, when the multisite feature is enabled, does not check for network-administrator privileges before performing a network-wide activation of an installed plugin, which might allow remote authenticated users to make unintended plugin changes by leveraging the Administrator role.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2012-4357 wp-admin/plugins.php in WordPress before 3.4.2, when the multisite feature is enabled, does not check for network-administrator privileges before performing a network-wide activation of an installed plugin, which might allow remote authenticated users to make unintended plugin changes by leveraging the Administrator role.
History

No history.

Weaknesses

Sources

Status
PUBLISHED
Assigner
redhat
Published
Updated
Sep 16, 2024, 9:02 PM
Reserved
Aug 21, 2012, 12:00 AM
Status
Modified
Published
Sep 14, 2012, 7:55 PM
Modified
Jun 16, 2026, 11:44 PM