CVE-2011-4898
** DISPUTED ** wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and...
CVE-2011-4898 is a medium vulnerability (CVSS 5.0) in Wordpress, published January 30, 2012. Its validity is disputed. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 9.21%, the 95th percentile.
- Severity
- 5.0 MediumCVSS 2.0, NVD
- Exploit chance
- 9.21%EPSS, 95th percentile
- Exploitation
- None known1 public exploit
- Fixed in
- No fix listedNo source names one
Description
wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier generates different error messages for requests lacking a dbname parameter depending on whether the MySQL credentials are valid, which makes it easier for remote attackers to conduct brute-force attacks via a series of requests with different uname and pwd parameters. NOTE: the vendor disputes the significance of this issue; also, it is unclear whether providing intentionally vague error messages during installation would be reasonable from a usability perspective
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
wordpressDebian:12 | All versions, plus listed versions 6.1.1+dfsg1-16.1.6+dfsg1-0+deb12u16.1.9+dfsg1-0+deb12u16.2+dfsg1-16.2.1+dfsg1-1 Show 26 moreShow less6.2.2+dfsg1-16.3+dfsg1-16.3.1+dfsg1-16.3.2+dfsg1-16.4.1+dfsg1-16.4.1+dfsg1-1.16.4.2+dfsg1-16.4.3+dfsg1-16.5+dfsg1-16.5.2+dfsg1-16.5.3+dfsg1-16.5.5+dfsg1-16.6.1+dfsg1-16.7.2+dfsg1-16.7.2+dfsg1-1.16.8.1+dfsg1-16.8.3+dfsg1-16.9+dfsg1-16.9.4+dfsg1-17.0+dfsg1-17.0.2+dfsg1-17.0.3+dfsg1-17.1+dfsg1-17.1.1+dfsg1-17.1.2+dfsg1-17.1.3+dfsg1-1 | None known |
wordpressDebian:13 | All versions, plus listed versions 6.8.1+dfsg1-16.8.10+dfsg1-0+deb13u16.8.3+dfsg1-0+deb13u16.8.3+dfsg1-16.8.6+dfsg1-0+deb13u1 Show 10 moreShow less6.8.7+dfsg1-0+deb13u16.9+dfsg1-16.9.4+dfsg1-17.0+dfsg1-17.0.2+dfsg1-17.0.3+dfsg1-17.1+dfsg1-17.1.1+dfsg1-17.1.2+dfsg1-17.1.3+dfsg1-1 | None known |
wordpressDebian:14 | All versions, plus listed versions 6.8.1+dfsg1-16.8.3+dfsg1-16.9+dfsg1-16.9.4+dfsg1-17.0+dfsg1-1 Show 6 moreShow less7.0.2+dfsg1-17.0.3+dfsg1-17.1+dfsg1-17.1.1+dfsg1-17.1.2+dfsg1-17.1.3+dfsg1-1 | None known |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | WordPress Core 3.3.1 - Multiple Vulnerabilities | 2012-01-25 |
What each source reports
NVD Score used
wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier generates different error messages for requests lacking a dbname parameter depending on whether the MySQL credentials are valid, which makes it easier for remote attackers to conduct brute-force attacks via a series of requests with different uname and pwd parameters. NOTE: the vendor disputes the significance of this issue; also, it is unclear whether providing intentionally vague error messages during installation would be reasonable from a usability perspective
- Record
CVE-2011-4898- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE ListNo score
wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier generates different error messages for requests lacking a dbname parameter depending on whether the MySQL credentials are valid, which makes it easier for remote attackers to conduct brute-force attacks via a series of requests with different uname and pwd parameters. NOTE: the vendor disputes the significance of this issue; also, it is unclear whether providing intentionally vague error messages during installation would be reasonable from a usability perspective
- Record
CVE-2011-4898- Updated
- 2026-11-02
EUVDEUVD-2011-4815No score
wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier generates different error messages for requests lacking a dbname parameter depending on whether the MySQL credentials are valid, which makes it easier for remote attackers to conduct brute-force attacks via a series of requests with different uname and pwd parameters. NOTE: the vendor disputes the significance of this issue; also, it is unclear whether providing intentionally vague error messages during installation would be reasonable from a usability perspective
- Record
EUVD-2011-4815- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-q2qm-9w2w-5x96No score
** DISPUTED ** wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and...
** DISPUTED ** wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier generates different error messages for requests lacking a dbname parameter depending on whether the MySQL credentials are valid, which makes it easier for remote attackers to conduct brute-force attacks via a series of requests with different uname and pwd parameters. NOTE: the vendor disputes the significance of this issue; also, it is unclear whether providing intentionally vague error messages during installation would be reasonable from a usability perspective.
- Record
GHSA-q2qm-9w2w-5x96- Weakness
- CWE-200
- Updated
- 2026-11-02
OSVNo score
wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier generates different error messages for requests lacking a dbname parameter depending on whether the MySQL credentials are valid, which makes it easier for remote attackers to conduct brute-force attacks via a series of requests with different uname and pwd parameters. NOTE: the vendor disputes the significance of this issue; also, it is unclear whether providing intentionally vague error messages during installation would be reasonable from a usability perspective
- Record
CVE-2011-4898- Updated
- 2026-11-02
OSVDEBIAN-CVE-2011-4898No score
wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier generates different error messages for requests lacking a dbname parameter depending on whether the MySQL credentials are valid, which makes it easier for remote attackers to conduct brute-force attacks via a series of requests with different uname and pwd parameters. NOTE: the vendor disputes the significance of this issue; also, it is unclear whether providing intentionally vague error messages during installation would be reasonable from a usability perspective
- Record
DEBIAN-CVE-2011-4898- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.