| Package | Affected versions | Patched versions |
|---|---|---|
| wordpress | ≤ 4.9 |
wp-admin/user-new.php in WordPress before 4.9.1 sets the newbloguser key to a string that can be directly derived from the user ID, which allows remote attackers to bypass intended access restrictions by entering this string.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free