PT-2014-8807

CVE-2014-9037

Published

2014-11-25

Updated

2016-06-30

Description by

CVSS 2.0

6.8

Medium

MetricsAV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 3.7.5 WordPress versions 3.8.x prior to 3.8.5 WordPress versions 3.9.x prior to 3.9.3 WordPress versions 4.x prior to 4.0.1

Description The issue allows remote attackers to obtain access to an account that has been idle since 2008. This is possible due to an improper PHP dynamic type comparison for an MD5 hash.

Recommendations For WordPress versions prior to 3.7.5, update to version 3.7.5 or later. For WordPress versions 3.8.x prior to 3.8.5, update to version 3.8.5 or later. For WordPress versions 3.9.x prior to 3.9.3, update to version 3.9.3 or later. For WordPress versions 4.x prior to 4.0.1, update to version 4.0.1 or later.

Exploitability

Fix

Researchers

Jouko Pynnonen

Vendors

Affected products

Weakness enumeration

CWE-310

Related identifiers

CVE-2014-9037

DLA-236-1

DSA-3085-1