WordPress core
CVE-2012-4422 wp-admin/plugins.php in WordPress before 3.4.2, when the multisite feature is enabled, does not check for network-administrator privileges before performing a network-wide activation of an installed plugin, which might allow remote authenticated users to make unintended plugin changes by leveraging the Administrator role.
Severity Low 3.5
Published 14 Sept 2012
Last changed 16 Jun 2026
Added to UpHeron 17 Oct 2026
Sources NVD Affected software Software Affected versions WordPressWordPress core · cpe:a:wordpress:wordpress Version 3.4.0 Version 3.3.3 Version 3.3.2 Version 3.3.1 All 88 release lines Every version up to 3.4.1 Version 0.71 Version 1.0 Version 1.0.1 Version 1.0.2 Version 1.1.1 Version 1.2 Version 1.2.1 Version 1.2.2 Version 1.2.3 Version 1.2.4 Version 1.2.5-a Version 1.2.5 Version 1.3 Version 1.3.2 Version 1.3.3 Version 1.5 Version 1.5.1 Version 1.5.1.1 Version 1.5.1.2 Version 1.5.1.3 Version 1.5.2 Version 2.0 Version 2.0.1 Version 2.0.2 Version 2.0.4 Version 2.0.5 Version 2.0.6 Version 2.0.7 Version 2.0.8 Version 2.0.9 Version 2.0.10 Version 2.0.11 Version 2.1 Version 2.1.1 Version 2.1.2 Version 2.1.3 Version 2.2 Version 2.2.1 Version 2.2.2 Version 2.2.3 Version 2.3 Version 2.3.1 Version 2.3.2 Version 2.3.3 Version 2.5 Version 2.5.1 Version 2.6 Version 2.6.1 Version 2.6.2 Version 2.6.3 Version 2.6.5 Version 2.7 Version 2.7.1 Version 2.8 Version 2.8.1 Version 2.8.2 Version 2.8.3 Version 2.8.4-a Version 2.8.4 Version 2.8.5 Version 2.8.5.1 Version 2.8.5.2 Version 2.8.6 Version 2.9 Version 2.9.1 Version 2.9.1.1 Version 2.9.2 Version 3.0 Version 3.0.1 Version 3.0.2 Version 3.0.3 Version 3.0.4 Version 3.0.5 Version 3.0.6 Version 3.1 Version 3.1.1 Version 3.1.2 Version 3.1.3 Version 3.1.4 Version 3.2-beta1 Version 3.2 Version 3.2.1 Version 3.3 Version 3.3.1 Version 3.3.2 Version 3.3.3 Version 3.4.0
References NVD https://nvd.nist.gov/vuln/detail/CVE-2012-4422 CVE.org https://www.cve.org/CVERecord?id=CVE-2012-4422