Description
WordPress 3.4.2 does not invalidate a wordpress_sec session cookie upon an administrator's logout action, which makes it easier for remote attackers to discover valid session identifiers via a brute-force attack, or modify data via a replay attack.
Remediation
References
Related Vulnerabilities
Atlassian Jira Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2019-20099)
ATutor Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2019-12170)
Chamilo Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2023-4220)
Moodle Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2015-0218)
IBM WebSEAL Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2018-1805)