CVE-2010-5297
WordPress before 3.0.1, when a Multisite installation is used, permanently retains the "site...
WordPress before 3.0.1, when a Multisite installation is used, permanently retains the "site administrators can add users" option once changed, which might allow remote authenticated administrators to bypass intended access restrictions in opportunistic circumstances via an add action after a temporary change.
Exploit likelihood
What each source reports
NVD Score used
WordPress before 3.0.1, when a Multisite installation is used, permanently retains the "site administrators can add users" option once changed, which might allow remote authenticated administrators to bypass intended access restrictions in opportunistic circumstances via an add action after a temporary change.
- Record
CVE-2010-5297- CVSS 2.0
- 2.1 Low
AV:N/AC:H/Au:S/C:N/I:P/A:N - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
WordPress before 3.0.1, when a Multisite installation is used, permanently retains the "site administrators can add users" option once changed, which might allow remote authenticated administrators to bypass intended access restrictions in opportunistic circumstances via an add action after a temporary change.
- Record
CVE-2010-5297- Updated
- 2026-11-02
EUVDEUVD-2010-5256 No score
WordPress before 3.0.1, when a Multisite installation is used, permanently retains the "site administrators can add users" option once changed, which might allow remote authenticated administrators to bypass intended access restrictions in opportunistic circumstances via an add action after a temporary change.
- Record
EUVD-2010-5256- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8cg5-rjxh-5v62 No score
WordPress before 3.0.1, when a Multisite installation is used, permanently retains the "site...
WordPress before 3.0.1, when a Multisite installation is used, permanently retains the "site administrators can add users" option once changed, which might allow remote authenticated administrators to bypass intended access restrictions in opportunistic circumstances via an add action after a temporary change.
- Record
GHSA-8cg5-rjxh-5v62- Updated
- 2026-11-02
OSV No score
WordPress before 3.0.1, when a Multisite installation is used, permanently retains the "site administrators can add users" option once changed, which might allow remote authenticated administrators to bypass intended access restrictions in opportunistic circumstances via an add action after a temporary change.
- Record
CVE-2010-5297- Updated
- 2026-11-02
OSVDEBIAN-CVE-2010-5297 No score
WordPress before 3.0.1, when a Multisite installation is used, permanently retains the "site administrators can add users" option once changed, which might allow remote authenticated administrators to bypass intended access restrictions in opportunistic circumstances via an add action after a temporary change.
- Record
DEBIAN-CVE-2010-5297- Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2010-5297 is a low vulnerability (CVSS 2.1) in Wordpress, published January 21, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.21%, the 82nd percentile. Fixed in wordpress 3.0.1-1.
References
codex.wordpress.org/Changelog/3.0.1
core.trac.wordpress.org/query?status=closed&group=resolution&order=priority&milestone=3.0.1&resolution=fixed
nvd.nist.gov/vuln/detail/CVE-2010-5297
github.com/advisories/GHSA-8cg5-rjxh-5v62
security-tracker.debian.org/tracker/CVE-2010-5297