Bugtraq mailing list archives
Re: Wordpress - Broken Access Control
From: otto () ottodestruct com
Date: 16 Dec 2007 10:07:29 -0000
The is_admin() function is not supposed to tell whether a user is an administrator or not, it tells whether the user is looking at one of the administration pages. As such, this function does exactly what it is supposed to do. As for the rest, there is no flaw. To view a draft, the user must authenticate and have the correct capability set. There is no way to view drafts without being logged in and having that capability set on the user's role level. This "vulnerability" is non-existent.
Current thread:
- Wordpress - Broken Access Control th3 . r00k . nospam (Dec 15)
- <Possible follow-ups>
- Re: Wordpress - Broken Access Control otto (Dec 17)
- Re: Wordpress - Broken Access Control Abel Cheung (Dec 19)
- Re: Wordpress - Broken Access Control th3 . r00k . nospam (Dec 18)
- Re: Wordpress - Broken Access Control otto (Dec 19)