Summary
generated automatically from NVD dataWordPress 1.5 and earlier is affected by an information disclosure flaw, classified as CWE-425 (direct request). A remote attacker can request files directly in wp-content/themes/, wp-includes/, or wp-admin/, triggering error messages that reveal the server's filesystem path. The issue is rated 5.3 (MEDIUM) under CVSS v3.1, with a low confidentiality impact and no required privileges or user interaction.
NVD description
Wordpress 1.5 and earlier allows remote attackers to obtain sensitive information via a direct request to files in (1) wp-content/themes/, (2) wp-includes/, or (3) wp-admin/, which reveal the path in an error message.
EPSS · FIRST.org
1.9%probability of exploitation in the next 30 days
Higher than 79% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-19, recomputed daily by FIRST.org.
CVSS v3.1 Score
Information
- Published
- 20 mai 2005
- Updated
- 16 juin 2026
- Status
- Modified
- Source
- cve@mitre.org
Affected products
Weaknesses (CWE)
References (2)
- http://marc.info/?l=bugtraq&m=111661517716733&w=2Third Party Advisory
- http://marc.info/?l=bugtraq&m=111661517716733&w=2Third Party Advisory
Similar CVEs
Other vulnerabilities of type CWE-425
Monitor your products
Get automatic alerts for every new CVE affecting your equipment.