Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-wtuc-n99m-fyby
Vulnerability ID VCID-wtuc-n99m-fyby
Aliases CVE-2007-1893
Summary xmlrpc (xmlrpc.php) in WordPress 2.1.2, and probably earlier, allows remote authenticated users with the contributor role to bypass intended access restrictions and invoke the publish_posts functionality, which can be used to "publish a previously saved post."
Status Published
Exploitability 0.5
Weighted Severity 4.4
Risk 2.2
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-264 Permissions, Privileges, and Access Controls
System Score Found at
epss 0.00189 https://api.first.org/data/v1/epss?cve=CVE-2007-1893
epss 0.00189 https://api.first.org/data/v1/epss?cve=CVE-2007-1893
epss 0.00189 https://api.first.org/data/v1/epss?cve=CVE-2007-1893
epss 0.00189 https://api.first.org/data/v1/epss?cve=CVE-2007-1893
epss 0.00189 https://api.first.org/data/v1/epss?cve=CVE-2007-1893
epss 0.00189 https://api.first.org/data/v1/epss?cve=CVE-2007-1893
epss 0.00189 https://api.first.org/data/v1/epss?cve=CVE-2007-1893
epss 0.00189 https://api.first.org/data/v1/epss?cve=CVE-2007-1893
cvssv2 4.9 https://nvd.nist.gov/vuln/detail/CVE-2007-1893
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2007-1893
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1893
http://secunia.com/advisories/24751
http://secunia.com/advisories/25108
https://exchange.xforce.ibmcloud.com/vulnerabilities/33470
http://trac.wordpress.org/ticket/4091
http://www.debian.org/security/2007/dsa-1285
http://www.notsosecure.com/folder2/2007/04/03/wordpress-212-xmlrpc-security-issues/
http://www.vupen.com/english/advisories/2007/1245
cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*
CVE-2007-1893 https://nvd.nist.gov/vuln/detail/CVE-2007-1893
No exploits are available.
Vector: AV:A/AC:M/Au:S/C:P/I:P/A:P Found at https://nvd.nist.gov/vuln/detail/CVE-2007-1893
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Exploit Prediction Scoring System (EPSS)
Percentile 0.40678
EPSS Score 0.00189
Published At April 1, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T16:30:18.335477+00:00 Debian Oval Importer Import https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 38.0.0