CVE-2014-5205

wp-includes/pluggable.php in WordPress before 3.9.2 does not use delimiters during concatenation of action values and uid values in CSRF tokens, which makes it easier for remote attackers to bypass a CSRF protection mechanism via a brute-force attack.

CVSS v2.0

6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P

EPSS

1.83% chance of exploitation in the next 30 days, 77th percentile

Nuclei

medium

Published

2014-08-18

Updated

2024-08-06

Nuclei templates (1)

• topscoder/nuclei-wordfence-cve/blob/main/nuclei-templates/2014/CVE-2014-5205-wordpress-ad…

References

• CVE Record
• NVD entry

Related

• CVE-2014-5204
• CVE-2014-5207
• CVE-2014-5203
• CVE-2014-5208
• CVE-2014-5201
• CVE-2014-5210