CVE-2009-2854

Wordpress before 2.8.3 does not check capabilities for certain actions, which allows remote attackers to make unauthorized edits or additions via a direct request to (1) edit-comments.php, (2) edit-pages.php, (3) edit.php, (4) edit-category-form.php, (5) edit-link-category-form.php, (6) edit-tag-form.php, (7) export.php, (8) import.php, or (9) link-add.php in wp-admin/.

• CWE-264

• http://core.trac.wordpress.org/changeset/11765Vendor Advisory
• http://core.trac.wordpress.org/changeset/11766Vendor Advisory
• http://wordpress.org/development/2009/08/wordpress-2-8-3-security-release/Patch, Vendor Advisory
• http://www.debian.org/security/2009/dsa-1871Third Party Advisory
• http://www.openwall.com/lists/oss-security/2009/08/04/5Mailing List, Third Party Advisory
• http://core.trac.wordpress.org/changeset/11765Vendor Advisory
• http://core.trac.wordpress.org/changeset/11766Vendor Advisory
• http://wordpress.org/development/2009/08/wordpress-2-8-3-security-release/Patch, Vendor Advisory
• http://www.debian.org/security/2009/dsa-1871Third Party Advisory
• http://www.openwall.com/lists/oss-security/2009/08/04/5Mailing List, Third Party Advisory

Published

Aug 18, 2009

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2009-2848The execve function in the Linux kernel, possibly 2.6.30-rc6…
• CVE-2009-2849The md driver (drivers/md/md.c) in the Linux kernel before 2…
• CVE-2009-2850Multiple buffer overflows in NASA Common Data Format (CDF) a…
• CVE-2009-2851Cross-site scripting (XSS) vulnerability in the administrato…
• CVE-2009-2852WP-Syntax plugin 0.9.1 and earlier for Wordpress, with regis…
• CVE-2009-2853Wordpress before 2.8.3 allows remote attackers to gain privi…
• CVE-2009-2855The strListGetItem function in src/HttpHeaderTools.c in Squi…
• CVE-2009-2856Sun Virtual Desktop Infrastructure (VDI) 3.0, when anonymous…
• CVE-2009-2857The kernel in Sun Solaris 8, 9, and 10, and OpenSolaris befo…5.5
• CVE-2009-2858Memory leak in the Security component in IBM DB2 8.1 before …
• CVE-2009-2859IBM DB2 8.1 before FP18 allows attackers to obtain unspecifi…
• CVE-2009-2860Unspecified vulnerability in db2jds in IBM DB2 8.1 before FP…