$ cve CVE-2011-4898 JSON

CVE-2011-4898 EXPLOIT

5.0

MEDIUM · CVSS 2.0 · EPSS 9.2% (pctl 95)

Patch early

A public exploit exists.

Description

wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier generates different error messages for requests lacking a dbname parameter depending on whether the MySQL credentials are valid, which makes it easier for remote attackers to conduct brute-force attacks via a series of requests with different uname and pwd parameters. NOTE: the vendor disputes the significance of this issue; also, it is unclear whether providing intentionally vague error messages during installation would be reasonable from a usability perspective

Scoring

CVSS	5.0 (MEDIUM, v2.0)
Vector	AV:N/AC:L/Au:N/C:N/I:N/A:P
EPSS	9.21% — more likely to be exploited than 95% of all CVEs
Weakness	CWE-200
On CISA KEV	no
Public exploit	yes
Published	2012-01-30
Last modified	2026-06-16

Affected (1)

Vendor	Product
wordpress	wordpress

Public exploits

Source	Title	Date
exploit-db	WordPress Core 3.3.1 - Multiple Vulnerabilities	2012-01-25

References

→ the Explorer · watch your stack · NVD