CVE-2015-5623: WordPress before 4.2.3 does not properly verify the edit_posts capability, which allows remote authenticate...

Security readout for executives and security teams

WordPress versions before 4.2.3 let a logged-in low-privilege Subscriber bypass an access check and create draft posts. This does not show unauthenticated compromise or code execution, but it breaks role boundaries on affected sites, especially where public registration is enabled. Exposure is limited to WordPress installations running versions before 4.2.3, particularly sites allowing untrusted users to authenticate as Subscribers. The provided affected-product metadata is incomplete, but the CVE description and WordPress references identify pre-4.2.3 WordPress core as affected. Treat as a targeted cleanup item for legacy WordPress estates. Prioritize internet-facing sites with user registration, but do not rank it with unauthenticated remote-code-execution issues based on the supplied evidence. Mitigation focus: Upgrade WordPress core to 4.2.3 or later.; Review WordPress and Debian advisories for package-specific backports.; Disable unnecessary public registration until affected sites are updated..

Prepared

Jun 13, 2026, 22:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.