CVE-2012-5868

WordPress 3.4.2 does not invalidate a wordpress_sec session cookie upon an administrator's logout action, which makes it easier for remote attackers to discover valid session identifiers via a brute-force attack, or modify data via a replay attack.

CVSS v2.0

2.6 LOWAV:N/AC:H/Au:N/C:P/I:N/A:N

EPSS

2.43% chance of exploitation in the next 30 days, 83th percentile

Nuclei

medium

Published

2012-12-27

Updated

2024-09-16

Proof-of-concept exploits (1)

• alexjasso/Project_7-WordPress_Pentesting0★ · 2018-03-30

Nuclei templates (1)

• topscoder/nuclei-wordfence-cve/blob/main/nuclei-templates/2012/CVE-2012-5868-wordpress-3c…

References

• CVE Record
• NVD entry

Related

• CVE-2012-5865
• CVE-2012-5872
• CVE-2012-5864
• CVE-2012-5873
• CVE-2012-5863
• CVE-2012-5874