CVE-2009-2335

CVE-2009-2335 describes a username enumeration vulnerability in WordPress and WordPress MU versions prior to 2.8.1, where differing login error messages reveal whether a user account exists. This vulnerability has a CVSS score of 5.0 (medium severity), indicating a network-based attack with low complexity that could lead to partial confidentiality impact by exposing valid usernames. While not listed in CISA's KEV catalog, exploit intelligence shows a Metasploit module exists for brute-force and user enumeration, though there is no evidence of active exploitation, significant community discussion, or media coverage.