What’s Vulnerable › Vulnerabilities

CVE-2008-2146

• Severity: high (CVSS 7.5 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2008-05-12 · updated 2026-06-16
• Weakness: CWE-264

Description

wp-includes/vars.php in Wordpress before 2.2.3 does not properly extract the current path from the PATH_INFO ($PHP_SELF), which allows remote attackers to bypass intended access restrictions for certain pages.

Affected products

• WordPress: through 2.2.2; 0.6.2, 0.6.2.1, 0.7, 0.71, 0.711, 1.0 (+40)

References

• http://osvdb.org/45188
• http://trac.wordpress.org/changeset/6029
• http://trac.wordpress.org/changeset?old_path=tags%2F2.2.2&old=6063&new_path=tags%2F2.2.3&new=6063#file10
• http://trac.wordpress.org/ticket/4748
• https://exchange.xforce.ibmcloud.com/vulnerabilities/42379
• http://osvdb.org/45188
• http://trac.wordpress.org/changeset/6029
• http://trac.wordpress.org/changeset?old_path=tags%2F2.2.2&old=6063&new_path=tags%2F2.2.3&new=6063#file10
• http://trac.wordpress.org/ticket/4748
• https://exchange.xforce.ibmcloud.com/vulnerabilities/42379

Get alerted when CVE-2008-2146 or the next vulnerability affects your stack