CVE-2007-1893
xmlrpc (xmlrpc.php) in WordPress 2.1.2, and probably earlier, allows remote authenticated users...
xmlrpc (xmlrpc.php) in WordPress 2.1.2, and probably earlier, allows remote authenticated users with the contributor role to bypass intended access restrictions and invoke the publish_posts functionality, which can be used to "publish a previously saved post."
Exploit likelihood
What each source reports
NVD Score used
xmlrpc (xmlrpc.php) in WordPress 2.1.2, and probably earlier, allows remote authenticated users with the contributor role to bypass intended access restrictions and invoke the publish_posts functionality, which can be used to "publish a previously saved post."
- Record
CVE-2007-1893- CVSS 2.0
- 4.9 Medium
AV:A/AC:M/Au:S/C:P/I:P/A:P - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
xmlrpc (xmlrpc.php) in WordPress 2.1.2, and probably earlier, allows remote authenticated users with the contributor role to bypass intended access restrictions and invoke the publish_posts functionality, which can be used to "publish a previously saved post."
- Record
CVE-2007-1893- Updated
- 2026-11-02
EUVDEUVD-2007-1887 No score
xmlrpc (xmlrpc.php) in WordPress 2.1.2, and probably earlier, allows remote authenticated users with the contributor role to bypass intended access restrictions and invoke the publish_posts functionality, which can be used to "publish a previously saved post."
- Record
EUVD-2007-1887- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-v744-f96h-39q4 No score
xmlrpc (xmlrpc.php) in WordPress 2.1.2, and probably earlier, allows remote authenticated users...
xmlrpc (xmlrpc.php) in WordPress 2.1.2, and probably earlier, allows remote authenticated users with the contributor role to bypass intended access restrictions and invoke the publish_posts functionality, which can be used to "publish a previously saved post."
- Record
GHSA-v744-f96h-39q4- Updated
- 2026-11-02
OSV No score
xmlrpc (xmlrpc.php) in WordPress 2.1.2, and probably earlier, allows remote authenticated users with the contributor role to bypass intended access restrictions and invoke the publish_posts functionality, which can be used to "publish a previously saved post."
- Record
CVE-2007-1893- Updated
- 2026-11-02
OSVDEBIAN-CVE-2007-1893 No score
xmlrpc (xmlrpc.php) in WordPress 2.1.2, and probably earlier, allows remote authenticated users with the contributor role to bypass intended access restrictions and invoke the publish_posts functionality, which can be used to "publish a previously saved post."
- Record
DEBIAN-CVE-2007-1893- Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| aliases | ||
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2007-1893 is a medium vulnerability (CVSS 4.9) in Wordpress, published April 9, 2007. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.20%, the 68th percentile. Fixed in wordpress 2.1.3-1.