CVE-2014-5204 in WordPress
Summary
wp-includes/pluggable.php in WordPress before 3.9.2 rejects invalid CSRF nonces with a different timing depending on which characters in the nonce are incorrect, which makes it easier for remote attackers to bypass a CSRF protection mechanism via a brute-force attack.
Reservation
08/13/2014
Disclosure
08/18/2014
Entries
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnerability | CWE | Exp | Cou | CVE |
|---|---|---|---|---|---|
| 67379 | WordPress pluggable.php cross-site request forgery | 352 | Unproven | Official fix | CVE-2014-5204 |