Description

WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to obtain access to an account idle since 2008 by leveraging an improper PHP dynamic type comparison for an MD5 hash.

Remediation

References

CVE-2014-9037

Related Vulnerabilities

WordPress Plugin Ajax Store Locator Directory Traversal (1.2.0)

WordPress Plugin YouTube Embed Cross-Site Scripting (5.2.1)

WordPress Plugin Advanced Custom Fields PRO Arbitrary File Upload (5.12.2)

WordPress Plugin Effectively Add & Customize Free Icons For WordPress Menus-WP Menu Icons Lite includes Backdoor [Only if downloaded via the vendor website] (1.0.8)

WordPress Plugin WP-Live Chat by 3CX Cross-Site Scripting (8.0.27)

Severity

Medium

Classification

CVE-2014-9037

Tags

Missing Update Known Vulnerabilities