CVE-2011-1762 in WordPress
Summary
by MITRE • 04/18/2022
A flaw exists in Wordpress related to the 'wp-admin/press-this.php 'script improperly checking user permissions when publishing posts. This may allow a user with 'Contributor-level' privileges to post as if they had 'publish_posts' permission.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/23/2026
The vulnerability in WordPress affects the wp-admin/press-this.php script which is designed to enable users to quickly create and publish content from external sources. This flaw represents a critical authorization bypass issue that undermines the platform's role-based access control mechanisms. The script fails to properly validate user permissions before allowing content publication, creating a pathway for unauthorized privilege escalation.
This security weakness stems from insufficient input validation and permission verification within the press-this functionality. When contributors attempt to publish content through this interface, the system does not adequately verify whether the user possesses the necessary publish_posts capability. The vulnerability exists because the script relies on incomplete permission checks that do not properly enforce WordPress's built-in capability-based access control model.
The operational impact of this vulnerability is significant as it allows low-privilege users to bypass intended security boundaries and publish content directly to the site. Contributors who should only be able to submit posts for review can exploit this flaw to immediately publish content with full authorship rights. This creates potential risks including unauthorized content modification, spam injection, and possible data integrity violations that could affect site reputation and user trust.
Security researchers have classified this type of vulnerability under CWE-285 which addresses improper authorization in software systems. The issue aligns with ATT&CK technique T1078.004 which covers valid accounts and credential abuse through privilege escalation. Organizations running WordPress installations are particularly vulnerable if they grant contributor roles to users who should not have publishing capabilities, as this flaw effectively removes the security boundary between these user levels.
Mitigation strategies include immediate application of WordPress core updates that address the permission checking logic in press-this.php. Administrators should also review and tighten user role assignments, ensuring that contributors do not receive unnecessary publishing privileges. Network-level monitoring can help detect unusual publishing patterns that might indicate exploitation attempts. Additionally, implementing proper security audits of WordPress plugins and themes is recommended as third-party code could potentially introduce similar permission bypass vulnerabilities. The fix typically involves strengthening the permission verification routine to ensure that all publication actions require explicit publish_posts capability checks before execution.