Hello Bugtraq! I want to warn you about vulnerabilities in WordPress. ----------------------------- Advisory: Vulnerabilities in WordPress ----------------------------- URL: http://websecurity.com.ua/4016/ ----------------------------- Timeline: 02.03.2010 - found the vulnerabilities. 02.03.2010 - didn't informed developers. After I informed WP developers about multiple vulnerabilities in WordPress in December 2007 and they ignored them - some didn't fix and some hiddenly fixed, without thanking me and referencing me (they even didn't mention about those fixed holes in release notes on official site) - starting from 2008 I never more inform them about vulnerabilities in WordPress. These holes were posted to Bugtraq (http://www.securityfocus.com/archive/1/archive/1/485786/100/0/threaded). 09.03.2010 - disclosed at my site. ----------------------------- Details: These are Brute Force and Insufficient Authorization vulnerabilities. Earlier in 2008 I already wrote about Brute Force vulnerability in WordPress (http://websecurity.com.ua/2007/), which was found by Kad already in 2007 (http://securityvulns.ru/Pdocument580.html). And as I found at 02.03.2010 in WordPress 2.9.2 this vulnerability still wasn't fixed. And also I found new vulnerabilities in WP. Brute Force: There is no protection from picking up of a password (from Brute Force attacks) in function of protecting pages/posts by a password. Insufficient Authorization: At every page/post in WP it's possible to set a password and these passwords can be equal. But function of accessing by a password writes global cookie, which works for the whole site. And so, after setting the password one time for one page/post, it's possible to see all protected pages/posts (with the same password, even without knowing that the password matches), because at a request to them the access will be granted automatically. Vulnerable are WordPress 2.9.2 and previous versions (all 2.x versions). I tested in different versions of WP, particularly in 2.0.11 and 2.9.2. Best wishes & regards, MustLive Administrator of Websecurity web site http://websecurity.com.ua