CVE-2006-3390
WordPress 2.0.3 allows remote attackers to obtain the installation path via a direct request to...
CVE-2006-3390 is a medium vulnerability (CVSS 5.0) in Wordpress, published July 6, 2006. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.86%, the 86th percentile. Fixed in wordpress 2.0.4-1.
- Severity
- 5.0 MediumCVSS 2.0, NVD
- Exploit chance
- 2.86%EPSS, 86th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2.0.4-1wordpress +2 more
Description
WordPress 2.0.3 allows remote attackers to obtain the installation path via a direct request to various files, such as those in the (1) wp-admin, (2) wp-content, and (3) wp-includes directories, possibly due to uninitialized variables.
Exploit likelihood
Affected products
Affected packages
What each source reports
NVD Score used
WordPress 2.0.3 allows remote attackers to obtain the installation path via a direct request to various files, such as those in the (1) wp-admin, (2) wp-content, and (3) wp-includes directories, possibly due to uninitialized variables.
- Record
CVE-2006-3390- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Updated
- 2026-11-02
CVE ListNo score
WordPress 2.0.3 allows remote attackers to obtain the installation path via a direct request to various files, such as those in the (1) wp-admin, (2) wp-content, and (3) wp-includes directories, possibly due to uninitialized variables.
- Record
CVE-2006-3390- Updated
- 2026-11-02
EUVDEUVD-2006-3386No score
WordPress 2.0.3 allows remote attackers to obtain the installation path via a direct request to various files, such as those in the (1) wp-admin, (2) wp-content, and (3) wp-includes directories, possibly due to uninitialized variables.
- Record
EUVD-2006-3386- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-p47w-r74f-f3j5No score
WordPress 2.0.3 allows remote attackers to obtain the installation path via a direct request to...
WordPress 2.0.3 allows remote attackers to obtain the installation path via a direct request to various files, such as those in the (1) wp-admin, (2) wp-content, and (3) wp-includes directories, possibly due to uninitialized variables.
- Record
GHSA-p47w-r74f-f3j5- Updated
- 2026-11-02
OSVNo score
WordPress 2.0.3 allows remote attackers to obtain the installation path via a direct request to various files, such as those in the (1) wp-admin, (2) wp-content, and (3) wp-includes directories, possibly due to uninitialized variables.
- Record
CVE-2006-3390- Updated
- 2026-11-02
OSVDEBIAN-CVE-2006-3390No score
WordPress 2.0.3 allows remote attackers to obtain the installation path via a direct request to various files, such as those in the (1) wp-admin, (2) wp-content, and (3) wp-includes directories, possibly due to uninitialized variables.
- Record
DEBIAN-CVE-2006-3390- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.