WordPress core
CVE-2013-2200 WordPress before 3.5.2 does not properly check the capabilities of roles, which allows remote authenticated users to bypass intended restrictions on publishing and authorship reassignment via unspecified vectors.
Severity Medium 4.0
Published 8 Jul 2013
Last changed 16 Jun 2026
Added to UpHeron 17 Oct 2026
Sources NVD Affected software Software Affected versions WordPressWordPress core · cpe:a:wordpress:wordpress Version 3.5.0 Version 3.4.2 Version 3.4.1 Version 3.4.0 All 77 release lines Every version up to 3.5.1 Version 0.71 Version 1.0 Version 1.0.1 Version 1.0.2 Version 1.1.1 Version 1.2 Version 1.2.1 Version 1.2.2 Version 1.2.3 Version 1.2.4 Version 1.2.5-a Version 1.2.5 Version 1.3 Version 1.3.2 Version 1.3.3 Version 1.5 Version 1.5.1 Version 1.5.1.1 Version 1.5.1.2 Version 1.5.1.3 Version 1.5.2 Version 1.6.2 Version 2.0 Version 2.0.1 Version 2.0.2 Version 2.0.4 Version 2.0.5 Version 2.0.6 Version 2.0.7 Version 2.0.8 Version 2.0.9 Version 2.0.10 Version 2.0.11 Version 2.1 Version 2.1.1 Version 2.1.2 Version 2.1.3 Version 2.2 Version 2.2.1 Version 2.2.2 Version 2.2.3 Version 2.3 Version 2.3.1 Version 2.3.2 Version 2.3.3 Version 2.5 Version 2.5.1 Version 2.6 Version 2.6.1 Version 2.6.2 Version 2.6.3 Version 2.6.5 Version 2.7 Version 2.7.1 Version 2.8 Version 2.8.1 Version 2.8.2 Version 2.8.3 Version 2.8.4-a Version 2.8.4 Version 2.8.5 Version 2.8.5.1 Version 2.8.5.2 Version 2.8.6 Version 2.9 Version 2.9.1 Version 2.9.1.1 Version 2.9.2 Version 3.3 Version 3.3.1 Version 3.3.2 Version 3.3.3 Version 3.4.0 Version 3.4.1 Version 3.4.2 Version 3.5.0
References NVD https://nvd.nist.gov/vuln/detail/CVE-2013-2200 CVE.org https://www.cve.org/CVERecord?id=CVE-2013-2200