CVE-2006-3389
index.php in WordPress 2.0.3 allows remote attackers to obtain sensitive information, such as SQL...
index.php in WordPress 2.0.3 allows remote attackers to obtain sensitive information, such as SQL table prefixes, via an invalid paged parameter, which displays the information in an SQL error message. NOTE: this issue has been disputed by a third party who states that the issue does not leak any target-specific information.
Exploit likelihood
What each source reports
NVD Score used
index.php in WordPress 2.0.3 allows remote attackers to obtain sensitive information, such as SQL table prefixes, via an invalid paged parameter, which displays the information in an SQL error message. NOTE: this issue has been disputed by a third party who states that the issue does not leak any target-specific information.
- Record
CVE-2006-3389- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Updated
- 2026-11-02
CVE List No score
index.php in WordPress 2.0.3 allows remote attackers to obtain sensitive information, such as SQL table prefixes, via an invalid paged parameter, which displays the information in an SQL error message. NOTE: this issue has been disputed by a third party who states that the issue does not leak any target-specific information.
- Record
CVE-2006-3389- Updated
- 2026-11-02
EUVDEUVD-2006-3385 No score
index.php in WordPress 2.0.3 allows remote attackers to obtain sensitive information, such as SQL table prefixes, via an invalid paged parameter, which displays the information in an SQL error message. NOTE: this issue has been disputed by a third party who states that the issue does not leak any target-specific information.
- Record
EUVD-2006-3385- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2m32-3qgh-qc3p No score
index.php in WordPress 2.0.3 allows remote attackers to obtain sensitive information, such as SQL...
index.php in WordPress 2.0.3 allows remote attackers to obtain sensitive information, such as SQL table prefixes, via an invalid paged parameter, which displays the information in an SQL error message. NOTE: this issue has been disputed by a third party who states that the issue does not leak any target-specific information.
- Record
GHSA-2m32-3qgh-qc3p- Updated
- 2026-11-02
OSV No score
index.php in WordPress 2.0.3 allows remote attackers to obtain sensitive information, such as SQL table prefixes, via an invalid paged parameter, which displays the information in an SQL error message. NOTE: this issue has been disputed by a third party who states that the issue does not leak any target-specific information.
- Record
CVE-2006-3389- Updated
- 2026-11-02
OSVDEBIAN-CVE-2006-3389 No score
index.php in WordPress 2.0.3 allows remote attackers to obtain sensitive information, such as SQL table prefixes, via an invalid paged parameter, which displays the information in an SQL error message. NOTE: this issue has been disputed by a third party who states that the issue does not leak any target-specific information.
- Record
DEBIAN-CVE-2006-3389- Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2006-3389 is a medium vulnerability (CVSS 5.0) in Wordpress, published July 6, 2006. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.94%, the 87th percentile. Fixed in wordpress 2.0.4-1.
References
securityfocus.com/archive/1/440127/100/0/threaded
securityreason.com/securityalert/1187
secunia.com/advisories/20928
Show 7 moreShow less
security.gentoo.org/glsa/glsa-200608-19.xml
vupen.com/english/advisories/2006/2661
nvd.nist.gov/vuln/detail/CVE-2006-3389
github.com/advisories/GHSA-2m32-3qgh-qc3p
security-tracker.debian.org/tracker/CVE-2006-3389