PT-2014-8803

CVE-2014-9033

Published

2014-11-25

Updated

2015-11-02

Description by

CVSS 2.0

6.8

Medium

MetricsAV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions WordPress versions 3.7.4, 3.8.4, 3.9.2, and 4.0

Description A cross-site request forgery (CSRF) issue exists, allowing remote attackers to hijack the authentication of arbitrary users for requests that reset passwords. This occurs in the wp-login.php file.

Recommendations For WordPress version 3.7.4, update to a version that includes the fix for this issue. For WordPress version 3.8.4, update to a version that includes the fix for this issue. For WordPress version 3.9.2, update to a version that includes the fix for this issue. For WordPress version 4.0, update to a version that includes the fix for this issue.

Exploitability

Fix

Impacts

Researchers

Jouko Pynnonen

Vendors

Affected products

Weakness enumeration

CWE-352: Cross-Site Request Forgery (CSRF)

Related identifiers

CVE-2014-9033

DLA-236-1