WordPress < 2.0.3 Arbitrary Code Injection
High Nessus Network Monitor Plugin ID 3647
SynopsisThe remote host is vulnerable to an arbitrary 'command insertion' flaw.
DescriptionThe remote WordPress application is vulnerable to an arbitrary 'code injection' flaw. The application fails to sanitize cached 'username' data. An attacker exploiting this flaw would send a malformed request to the WordPress application. Successful exploitation would result in the attacker running arbitrary commands with the permission of the WordPress application.
SolutionUpgrade to WordPress 2.0.3, or later.