CVE-2009-2335
WordPress and WordPress MU before 2.8.1 exhibit different behavior for a failed login attempt...
WordPress and WordPress MU before 2.8.1 exhibit different behavior for a failed login attempt depending on whether the user account exists, which allows remote attackers to enumerate valid usernames. NOTE: the vendor reportedly disputes the significance of this issue, indicating that the behavior exists for "user convenience."
Exploit likelihood
What each source reports
NVD Score used
WordPress and WordPress MU before 2.8.1 exhibit different behavior for a failed login attempt depending on whether the user account exists, which allows remote attackers to enumerate valid usernames. NOTE: the vendor reportedly disputes the significance of this issue, indicating that the behavior exists for "user convenience."
- Record
CVE-2009-2335- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-16
- Updated
- 2026-11-02
CVE List No score
WordPress and WordPress MU before 2.8.1 exhibit different behavior for a failed login attempt depending on whether the user account exists, which allows remote attackers to enumerate valid usernames. NOTE: the vendor reportedly disputes the significance of this issue, indicating that the behavior exists for "user convenience."
- Record
CVE-2009-2335- Updated
- 2026-11-02
EUVDEUVD-2009-2331 No score
WordPress and WordPress MU before 2.8.1 exhibit different behavior for a failed login attempt depending on whether the user account exists, which allows remote attackers to enumerate valid usernames. NOTE: the vendor reportedly disputes the significance of this issue, indicating that the behavior exists for "user convenience."
- Record
EUVD-2009-2331- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4643-w74c-m4wv No score
WordPress and WordPress MU before 2.8.1 exhibit different behavior for a failed login attempt...
WordPress and WordPress MU before 2.8.1 exhibit different behavior for a failed login attempt depending on whether the user account exists, which allows remote attackers to enumerate valid usernames. NOTE: the vendor reportedly disputes the significance of this issue, indicating that the behavior exists for "user convenience."
- Record
GHSA-4643-w74c-m4wv- Updated
- 2026-11-02
OSV No score
WordPress and WordPress MU before 2.8.1 exhibit different behavior for a failed login attempt depending on whether the user account exists, which allows remote attackers to enumerate valid usernames. NOTE: the vendor reportedly disputes the significance of this issue, indicating that the behavior exists for "user convenience."
- Record
CVE-2009-2335- Updated
- 2026-11-02
OSVDEBIAN-CVE-2009-2335 No score
WordPress and WordPress MU before 2.8.1 exhibit different behavior for a failed login attempt depending on whether the user account exists, which allows remote attackers to enumerate valid usernames. NOTE: the vendor reportedly disputes the significance of this issue, indicating that the behavior exists for "user convenience."
- Record
DEBIAN-CVE-2009-2335- Updated
- 2026-11-02
Affected products
Affected packages
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | WordPress Plugin Block-Spam-By-Math-Reloaded - Bypass | 2011-08-20 |
| Metasploit | WordPress Brute Force and User Enumeration Utility |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-2335 is a medium vulnerability (CVSS 5.0) in Wordpress, published July 10, 2009. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 85.0%, the 99th percentile. Fixed in wordpress 2.8.3-1.
References
redhat.com/archives/fedora-package-announce/2009-August/msg00608.html
corelabs.coresecurity.com/index.php?action=view&type=advisory&name=WordPress_Privileges_Unchecked
securityfocus.com/archive/1/504795/100/0/threaded
securitytracker.com/id?1022528
Show 8 moreShow less
vupen.com/english/advisories/2009/1833
osvdb.org/55713
exploit-db.com/exploits/9110
nvd.nist.gov/vuln/detail/CVE-2009-2335
github.com/advisories/GHSA-4643-w74c-m4wv
security-tracker.debian.org/tracker/CVE-2009-2335