CVE-2014-5205 in WordPress
Summary
wp-includes/pluggable.php in WordPress before 3.9.2 does not use delimiters during concatenation of action values and uid values in CSRF tokens, which makes it easier for remote attackers to bypass a CSRF protection mechanism via a brute-force attack.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Reservation
08/13/2014
Disclosure
08/18/2014
Status
Confirmed
Entries
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnerability | CWE | Exp | Cou | CVE |
|---|---|---|---|---|---|
| 67378 | WordPress pluggable.php cross-site request forgery | 352 | Unproven | Official fix | CVE-2014-5205 |