CVE-2009-2432: WordPress

Medium severity, CVSS 5.0. EPSS: 3.1% chance of exploitation in the next 30 days.

WordPress and WordPress MU before 2.8.1 allow remote attackers to obtain sensitive information via a direct request to wp-settings.php, which reveals the installation path in an error message.

Affected products

• WordPress WordPress: up to and including 2.7.1; version 0.6.2 only; version 0.6.2.1 only; version 0.7 only; version 0.71 only; version 0.71-gold only; …
• WordPress WordPress Mu: up to and including 2.7; version 1.1 only; version 1.1.1 only; version 1.2 only; version 1.2.1 only; version 1.2.2 only; …

Published 2009-07-10. Last modified 2026-06-16.