CVE-2009-2334
wp-admin/admin.php in WordPress and WordPress MU before 2.8.1 does not require administrative...
wp-admin/admin.php in WordPress and WordPress MU before 2.8.1 does not require administrative authentication to access the configuration of a plugin, which allows remote attackers to specify a configuration file in the page parameter to obtain sensitive information or modify this file, as demonstrated by the (1) collapsing-archives/options.txt, (2) akismet/readme.txt, (3) related-ways-to-take-action/options.php, (4) wp-security-scan/securityscan.php, and (5) wp-ids/ids-admin.php files. NOTE: this can be leveraged for cross-site scripting (XSS) and denial of service.
Exploit likelihood
What each source reports
NVD Score used
wp-admin/admin.php in WordPress and WordPress MU before 2.8.1 does not require administrative authentication to access the configuration of a plugin, which allows remote attackers to specify a configuration file in the page parameter to obtain sensitive information or modify this file, as demonstrated by the (1) collapsing-archives/options.txt, (2) akismet/readme.txt, (3) related-ways-to-take-action/options.php, (4) wp-security-scan/securityscan.php, and (5) wp-ids/ids-admin.php files. NOTE: this can be leveraged for cross-site scripting (XSS) and denial of service.
- Record
CVE-2009-2334- CVSS 2.0
- 4.9 Medium
AV:N/AC:M/Au:S/C:P/I:P/A:N - Weakness
- CWE-287
- Updated
- 2026-11-02
CVE List No score
wp-admin/admin.php in WordPress and WordPress MU before 2.8.1 does not require administrative authentication to access the configuration of a plugin, which allows remote attackers to specify a configuration file in the page parameter to obtain sensitive information or modify this file, as demonstrated by the (1) collapsing-archives/options.txt, (2) akismet/readme.txt, (3) related-ways-to-take-action/options.php, (4) wp-security-scan/securityscan.php, and (5) wp-ids/ids-admin.php files. NOTE: this can be leveraged for cross-site scripting (XSS) and denial of service.
- Record
CVE-2009-2334- Updated
- 2026-11-02
EUVDEUVD-2009-2330 No score
wp-admin/admin.php in WordPress and WordPress MU before 2.8.1 does not require administrative authentication to access the configuration of a plugin, which allows remote attackers to specify a configuration file in the page parameter to obtain sensitive information or modify this file, as demonstrated by the (1) collapsing-archives/options.txt, (2) akismet/readme.txt, (3) related-ways-to-take-action/options.php, (4) wp-security-scan/securityscan.php, and (5) wp-ids/ids-admin.php files. NOTE: this can be leveraged for cross-site scripting (XSS) and denial of service.
- Record
EUVD-2009-2330- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-54c4-23hm-v988 No score
wp-admin/admin.php in WordPress and WordPress MU before 2.8.1 does not require administrative...
wp-admin/admin.php in WordPress and WordPress MU before 2.8.1 does not require administrative authentication to access the configuration of a plugin, which allows remote attackers to specify a configuration file in the page parameter to obtain sensitive information or modify this file, as demonstrated by the (1) collapsing-archives/options.txt, (2) akismet/readme.txt, (3) related-ways-to-take-action/options.php, (4) wp-security-scan/securityscan.php, and (5) wp-ids/ids-admin.php files. NOTE: this can be leveraged for cross-site scripting (XSS) and denial of service.
- Record
GHSA-54c4-23hm-v988- Weakness
- CWE-287
- Updated
- 2026-11-02
OSV No score
wp-admin/admin.php in WordPress and WordPress MU before 2.8.1 does not require administrative authentication to access the configuration of a plugin, which allows remote attackers to specify a configuration file in the page parameter to obtain sensitive information or modify this file, as demonstrated by the (1) collapsing-archives/options.txt, (2) akismet/readme.txt, (3) related-ways-to-take-action/options.php, (4) wp-security-scan/securityscan.php, and (5) wp-ids/ids-admin.php files. NOTE: this can be leveraged for cross-site scripting (XSS) and denial of service.
- Record
CVE-2009-2334- Updated
- 2026-11-02
OSVDEBIAN-CVE-2009-2334 No score
wp-admin/admin.php in WordPress and WordPress MU before 2.8.1 does not require administrative authentication to access the configuration of a plugin, which allows remote attackers to specify a configuration file in the page parameter to obtain sensitive information or modify this file, as demonstrated by the (1) collapsing-archives/options.txt, (2) akismet/readme.txt, (3) related-ways-to-take-action/options.php, (4) wp-security-scan/securityscan.php, and (5) wp-ids/ids-admin.php files. NOTE: this can be leveraged for cross-site scripting (XSS) and denial of service.
- Record
DEBIAN-CVE-2009-2334- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
wordpressDebian:12 |
before 2.8.3-1 | 2.8.3-1 |
wordpressDebian:13 |
before 2.8.3-1 | 2.8.3-1 |
wordpressDebian:14 |
before 2.8.3-1 | 2.8.3-1 |
wordpressDebian:4.0 From an advisory covering 11 CVEs |
before 2.0.10-1etch4, plus listed versions 2.0.10-12.0.10-1etch12.0.10-1etch22.0.10-1etch32.0.10-1~bpo.12.0.9-1 |
2.0.10-1etch4 |
wordpressDebian:5.0 From an advisory covering 11 CVEs |
before 2.5.1-11+lenny1, plus listed versions 2.5.1-11 |
2.5.1-11+lenny1 |
wordpressDebian:4.0 From an advisory covering 11 CVEs |
before 2.0.10-1etch5, plus listed versions 2.0.10-12.0.10-1etch12.0.10-1etch22.0.10-1etch32.0.10-1etch42.0.10-1~bpo.12.0.9-1 |
2.0.10-1etch5 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | WordPress Core / MU / Plugins - '/admin.php' Privileges Unchecked / Multiple Information Disclosures | 2009-07-10 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-2334 is a medium vulnerability (CVSS 4.9) in Wordpress, published July 10, 2009. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 6.26%, the 93rd percentile. Fixed in wordpress 2.8.3-1.
References
redhat.com/archives/fedora-package-announce/2009-August/msg00608.html
corelabs.coresecurity.com/index.php?action=view&type=advisory&name=WordPress_Privileges_Unchecked
wordpress.org/development/2009/07/wordpress-2-8-1
securityfocus.com/archive/1/504795/100/0/threaded
securitytracker.com/id?1022528
Show 11 moreShow less
vupen.com/english/advisories/2009/1833
debian.org/security/2009/dsa-1871
osvdb.org/55712
exploit-db.com/exploits/9110
nvd.nist.gov/vuln/detail/CVE-2009-2334
github.com/advisories/GHSA-54c4-23hm-v988
security-tracker.debian.org/tracker/CVE-2009-2334