Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-9dcr-4f3a-myfs
Vulnerability ID VCID-9dcr-4f3a-myfs
Aliases CVE-2010-5296
Summary wp-includes/capabilities.php in WordPress before 3.0.2, when a Multisite configuration is used, does not require the Super Admin role for the delete_users capability, which allows remote authenticated administrators to bypass intended access restrictions via a delete action.
Status Published
Exploitability 0.5
Weighted Severity 0.0
Risk None
Affected and Fixed Packages Package Details
Weaknesses (0)
There are no known CWE.
System Score Found at
epss 0.00404 https://api.first.org/data/v1/epss?cve=CVE-2010-5296
epss 0.00404 https://api.first.org/data/v1/epss?cve=CVE-2010-5296
epss 0.00404 https://api.first.org/data/v1/epss?cve=CVE-2010-5296
epss 0.00404 https://api.first.org/data/v1/epss?cve=CVE-2010-5296
epss 0.00404 https://api.first.org/data/v1/epss?cve=CVE-2010-5296
epss 0.00404 https://api.first.org/data/v1/epss?cve=CVE-2010-5296
epss 0.00404 https://api.first.org/data/v1/epss?cve=CVE-2010-5296
epss 0.00404 https://api.first.org/data/v1/epss?cve=CVE-2010-5296
epss 0.00404 https://api.first.org/data/v1/epss?cve=CVE-2010-5296
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2010-5296
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-5296
No exploits are available.
There are no known vectors.
Exploit Prediction Scoring System (EPSS)
Percentile 0.6082
EPSS Score 0.00404
Published At April 1, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T16:30:47.897917+00:00 Debian Oval Importer Import https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 38.0.0