WordPress Multiple Vulnerabilities

Multiple vulnerabilities have been identified in WordPress. A remote authenticated user can obtain elevated privileges on the target application, conduct cross-site scripting and request forgery attacks, and determine the upload path.

1. A remote user can conduct server-side request forgery (SSRF) attacks via the HTTP API to potentially access the target site.
2. A remote authenticated user with contributor privileges can publish posts and reassign the ownership of posts.
3. A remote user can conduct cross-site scripting attacks via SWFUpload, when uploading media, editing media and when installing or updating plugins and themes.
4. A remote user can spoof content via a Flash applet due to a flaw in the TinyMCE Media Plugin
5. A remote user can determine the full upload path during file upload
6. A remote user can conduct an XML external entity (XXE) injection attack via oEmbed to obtain potentially sensitive information