Description

wp-login.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to reset passwords by leveraging access to an e-mail account that received a password-reset message.

Remediation

References

CVE-2014-9039

Related Vulnerabilities

WordPress Plugin User Avatar TimThumb Arbitrary File Upload (1.3.7)

MediaWiki Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2012-4382)

MySQL CVE-2022-21368 Vulnerability (CVE-2022-21368)

Jboss EAP Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') Vulnerability (CVE-2014-0226)

Drupal Core 6.x Local File Inclusion (6.0 - 6.9)

Severity

Medium

Classification

CVE-2014-9039

Tags

Missing Update Known Vulnerabilities