Alexander Concha has reported a vulnerability in WordPress MU, which can be exploited by malicious users to bypass certain security restrictions and to compromise a vulnerable system.

The wp-admin/options.php script does not properly restrict changes to options. This can be exploited to e.g. upload and execute arbitrary PHP code.

Successful exploitation requires valid user credentials and having "manage_options" capabilities. Successful exploitation for file uploading also requires "upload_files" capabilities.

The vulnerability is reported in version 1.3.1. Prior versions may also be affected.

Solution
Update to version 1.3.2 or later.

Provided and/or discovered by
Alexander Concha

Changelog
Further details available to Secunia VIM customers

Original Advisory
WordPress MU:
http://mu.wordpress.org/forums/topic.php?id=7534&page&replies=1

Alexander Concha:
http://www.buayacorp.com/files/wordpress/wordpress-mu-options-overwrite.html

Deep Links
Links available to Secunia VIM customers