CVE-2008-3747: The (1) get_edit_post_link and (2) get_edit_comment_link functions in wp-includes/link-template.php in Word...

Security readout for executives and security teams

This issue affects old WordPress installations before 2.6.1. Certain edit links could fail to force SSL when they should, exposing an administrator’s cookie on the network. If captured, that cookie could let an attacker gain administrative access. The source bundle does not show active exploitation. Exposure is mainly legacy WordPress before 2.6.1, especially where administrators used HTTP, mixed HTTP/HTTPS, or untrusted networks. Modern WordPress versions should not be assumed affected from this bundle alone. Prioritize immediately only if legacy WordPress is still present. The business risk is full site administration compromise, but exposure should be rare in maintained environments. Mitigation focus: Identify and retire any WordPress installation older than 2.6.1.; Upgrade affected WordPress instances to 2.6.1 or later per vendor guidance.; Require HTTPS for all administrative WordPress traffic..

Prepared

Jun 28, 2026, 18:33 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.