CVE-2009-2336
The forgotten mail interface in WordPress and WordPress MU before 2.8.1 exhibits different...
The forgotten mail interface in WordPress and WordPress MU before 2.8.1 exhibits different behavior for a password request depending on whether the user account exists, which allows remote attackers to enumerate valid usernames. NOTE: the vendor reportedly disputes the significance of this issue, indicating that the behavior exists for "user convenience."
Exploit likelihood
What each source reports
NVD Score used
The forgotten mail interface in WordPress and WordPress MU before 2.8.1 exhibits different behavior for a password request depending on whether the user account exists, which allows remote attackers to enumerate valid usernames. NOTE: the vendor reportedly disputes the significance of this issue, indicating that the behavior exists for "user convenience."
- Record
CVE-2009-2336- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-16
- Updated
- 2026-11-02
CVE List No score
The forgotten mail interface in WordPress and WordPress MU before 2.8.1 exhibits different behavior for a password request depending on whether the user account exists, which allows remote attackers to enumerate valid usernames. NOTE: the vendor reportedly disputes the significance of this issue, indicating that the behavior exists for "user convenience."
- Record
CVE-2009-2336- Updated
- 2026-11-02
EUVDEUVD-2009-2332 No score
The forgotten mail interface in WordPress and WordPress MU before 2.8.1 exhibits different behavior for a password request depending on whether the user account exists, which allows remote attackers to enumerate valid usernames. NOTE: the vendor reportedly disputes the significance of this issue, indicating that the behavior exists for "user convenience."
- Record
EUVD-2009-2332- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4cc8-gf3c-3mrc No score
The forgotten mail interface in WordPress and WordPress MU before 2.8.1 exhibits different...
The forgotten mail interface in WordPress and WordPress MU before 2.8.1 exhibits different behavior for a password request depending on whether the user account exists, which allows remote attackers to enumerate valid usernames. NOTE: the vendor reportedly disputes the significance of this issue, indicating that the behavior exists for "user convenience."
- Record
GHSA-4cc8-gf3c-3mrc- Updated
- 2026-11-02
OSV No score
The forgotten mail interface in WordPress and WordPress MU before 2.8.1 exhibits different behavior for a password request depending on whether the user account exists, which allows remote attackers to enumerate valid usernames. NOTE: the vendor reportedly disputes the significance of this issue, indicating that the behavior exists for "user convenience."
- Record
CVE-2009-2336- Updated
- 2026-11-02
OSVDEBIAN-CVE-2009-2336 No score
The forgotten mail interface in WordPress and WordPress MU before 2.8.1 exhibits different behavior for a password request depending on whether the user account exists, which allows remote attackers to enumerate valid usernames. NOTE: the vendor reportedly disputes the significance of this issue, indicating that the behavior exists for "user convenience."
- Record
DEBIAN-CVE-2009-2336- Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-2336 is a medium vulnerability (CVSS 5.0) in Wordpress, published July 10, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.41%, the 92nd percentile. Fixed in wordpress 2.8.3-1.
References
redhat.com/archives/fedora-package-announce/2009-August/msg00608.html
corelabs.coresecurity.com/index.php?action=view&type=advisory&name=WordPress_Privileges_Unchecked
securityfocus.com/archive/1/504795/100/0/threaded
securitytracker.com/id?1022528
Show 8 moreShow less
vupen.com/english/advisories/2009/1833
exploit-db.com/exploits/9110
osvdb.org/55714
nvd.nist.gov/vuln/detail/CVE-2009-2336
github.com/advisories/GHSA-4cc8-gf3c-3mrc
security-tracker.debian.org/tracker/CVE-2009-2336