← Database

CVE-2008-2146

HIGH CVSS: 7.5 Published: 2008-05-12 Modified: 2026-06-16

Description

wp-includes/vars.php in Wordpress before 2.2.3 does not properly extract the current path from the PATH_INFO ($PHP_SELF), which allows remote attackers to bypass intended access restrictions for certain pages.

Affected Platforms

Wordpress Wordpress

Weakness Type

CWE-264

References