Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-ysde-2c1f-r3a3
Vulnerability ID VCID-ysde-2c1f-r3a3
Aliases CVE-2008-2146
Summary wp-includes/vars.php in Wordpress before 2.2.3 does not properly extract the current path from the PATH_INFO ($PHP_SELF), which allows remote attackers to bypass intended access restrictions for certain pages.
Status Published
Exploitability 0.5
Weighted Severity 0.0
Risk None
Affected and Fixed Packages Package Details
Weaknesses (0)
There are no known CWE.
System Score Found at
epss 0.00583 https://api.first.org/data/v1/epss?cve=CVE-2008-2146
epss 0.00583 https://api.first.org/data/v1/epss?cve=CVE-2008-2146
epss 0.00583 https://api.first.org/data/v1/epss?cve=CVE-2008-2146
epss 0.00583 https://api.first.org/data/v1/epss?cve=CVE-2008-2146
epss 0.00583 https://api.first.org/data/v1/epss?cve=CVE-2008-2146
epss 0.00583 https://api.first.org/data/v1/epss?cve=CVE-2008-2146
epss 0.00583 https://api.first.org/data/v1/epss?cve=CVE-2008-2146
epss 0.00583 https://api.first.org/data/v1/epss?cve=CVE-2008-2146
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2008-2146
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2146
No exploits are available.
There are no known vectors.
Exploit Prediction Scoring System (EPSS)
Percentile 0.68909
EPSS Score 0.00583
Published At April 1, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T16:30:26.973483+00:00 Debian Oval Importer Import https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 38.0.0