CVE-2014-0165 in WordPress
Summary
by MITRE
WordPress before 3.7.2 and 3.8.x before 3.8.2 allows remote authenticated users to publish posts by leveraging the Contributor role, related to wp-admin/includes/post.php and wp-admin/includes/class-wp-posts-list-table.php.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 05/10/2026
This vulnerability exists in WordPress versions prior to 3.7.2 and 3.8.x versions prior to 3.8.2, representing a significant authorization bypass flaw that undermines the role-based access control system. The issue stems from insufficient validation of user permissions within the administrative interface, specifically affecting users with the Contributor role who should normally be restricted from publishing posts directly. The vulnerability is rooted in the wp-admin/includes/post.php and wp-admin/includes/class-wp-posts-list-table.php files where the code fails to properly verify whether a user has the necessary capabilities to publish content, despite their role level.
The technical implementation flaw allows authenticated users with Contributor privileges to manipulate the publishing workflow through direct API calls or interface interactions that bypass normal permission checks. This occurs because the system does not adequately validate the user's ability to transition a post from draft status to published status, effectively enabling privilege escalation within the content management system. The vulnerability is classified under CWE-284 which addresses improper access control, specifically concerning insufficient authorization checks during post publication processes. Attackers can exploit this weakness by crafting specific requests that leverage the Contributor role's existing permissions to execute unauthorized publishing actions.
The operational impact of this vulnerability is substantial as it enables malicious users or compromised accounts with Contributor level access to bypass content moderation controls that are typically enforced by WordPress's role-based permissions system. This creates a scenario where unauthorized content can be published without proper review, potentially leading to spam, malicious content distribution, or disruption of legitimate content workflows. The vulnerability directly impacts content integrity and can be exploited by attackers who have gained access to Contributor accounts, either through credential compromise or social engineering attacks. Organizations relying on WordPress for content management face significant risks when this vulnerability exists, as it undermines the fundamental security model that separates content creation from publication privileges.
The exploitation of this vulnerability can be facilitated through various attack vectors including direct API manipulation, browser-based attacks, or by leveraging existing Contributor accounts to publish malicious content. The attack pattern aligns with ATT&CK technique T1078 which covers valid accounts and privilege escalation through legitimate system access. Mitigation strategies should include immediate upgrade to WordPress versions 3.7.2 or 3.8.2, which contain the necessary patches to enforce proper permission validation. Additionally, administrators should implement network monitoring to detect unusual publishing activities, review user access permissions regularly, and consider implementing additional security layers such as two-factor authentication for privileged accounts. The vulnerability demonstrates the importance of maintaining up-to-date software versions and proper access control validation within web applications, as even seemingly minor permission flaws can create significant security risks when exploited by attackers.