Secunia

zero has discovered a weakness in WordPress, which can be exploited by malicious people to disclose system information.

The problem is that SQL error messages are returned to the user. This can be exploited to disclose the configured table prefix via an invalid "paged" parameter passed in index.php.

Example:
http://[host]/index.php?paged=-1

It is also possible to disclose the full path to certain scripts by accessing them directly.

The weakness has been confirmed in version 2.0.3. Other versions may also be affected.

Solution
Update to version 2.1.

Provided and/or discovered by
zero, Moroccan Security Team

Changelog
Further details available in Customer Area

Deep Links
Links available in Customer Area