CVE-2014-6412

WordPress before 4.4 makes it easier for remote attackers to predict password-recovery tokens via a brute-force approach.

Score

CVSS 3.0 8.1 High

Status

Modified - cve@mitre.org

Published

2018-04-12

Last modified

2024-08-06

Weaknesses

CWE-640

Affected products

• Wordpress (Wordpress)

References

• http://packetstormsecurity.com/files/130380/WordPress-Failed-Randomness.html
• http://seclists.org/fulldisclosure/2015/Feb/42
• http://seclists.org/fulldisclosure/2015/Feb/53
• http://www.securityfocus.com/bid/72589
• http://www.securitytracker.com/id/1031749
• https://bugzilla.redhat.com/show_bug.cgi?id=1192474
• https://core.trac.wordpress.org/ticket/28633