CVE-2009-2336

The forgotten mail interface in WordPress and WordPress MU before 2.8.1 exhibits different behavior for a password request depending on whether the user account exists, which allows remote attackers to enumerate valid usernames. NOTE: the vendor reportedly disputes the significance of this issue, indicating that the behavior exists for "user convenience."

• CWE-16

• http://corelabs.coresecurity.com/index.php?action=view&type=advisory&name=WordPress_Privileges_UncheckedExploit, Patch, Third Party Advisory
• http://securitytracker.com/id?1022528Patch, Third Party Advisory, VDB Entry
• http://www.exploit-db.com/exploits/9110Third Party Advisory, VDB Entry
• http://www.osvdb.org/55714Broken Link, Patch
• http://www.securityfocus.com/archive/1/504795/100/0/threadedThird Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/35581Third Party Advisory, VDB Entry
• http://www.vupen.com/english/advisories/2009/1833Patch, Third Party Advisory
• https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00597.htmlThird Party Advisory
• https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00608.htmlThird Party Advisory
• https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00632.htmlThird Party Advisory
• https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00676.htmlThird Party Advisory
• http://corelabs.coresecurity.com/index.php?action=view&type=advisory&name=WordPress_Privileges_UncheckedExploit, Patch, Third Party Advisory
• http://securitytracker.com/id?1022528Patch, Third Party Advisory, VDB Entry
• http://www.exploit-db.com/exploits/9110Third Party Advisory, VDB Entry
• http://www.osvdb.org/55714Broken Link, Patch
• http://www.securityfocus.com/archive/1/504795/100/0/threadedThird Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/35581Third Party Advisory, VDB Entry
• http://www.vupen.com/english/advisories/2009/1833Patch, Third Party Advisory
• https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00597.htmlThird Party Advisory
• https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00608.htmlThird Party Advisory
• https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00632.htmlThird Party Advisory
• https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00676.htmlThird Party Advisory

Published

Jul 10, 2009

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2009-2330Cross-site scripting (XSS) vulnerability in admin/admin_menu…
• CVE-2009-2331Multiple static code injection vulnerabilities in CMS Chainu…
• CVE-2009-2332CMS Chainuk 1.2 and earlier allows remote attackers to obtai…
• CVE-2009-2333Multiple directory traversal vulnerabilities in CMS Chainuk …
• CVE-2009-2334wp-admin/admin.php in WordPress and WordPress MU before 2.8.…
• CVE-2009-2335WordPress and WordPress MU before 2.8.1 exhibit different be…
• CVE-2009-2337SQL injection vulnerability in includes/module/book/index.in…
• CVE-2009-2338Directory traversal vulnerability in includes/startmodules.i…
• CVE-2009-2339SQL injection vulnerability in index.php in Rentventory allo…
• CVE-2009-2340SQL injection vulnerability in admin/index.php in Opial 1.0 …
• CVE-2009-2341SQL injection vulnerability in albumdetail.php in Opial 1.0 …
• CVE-2009-2342Cross-site scripting (XSS) vulnerability in admin.php (aka t…