CVE-2015-5730

The sanitize_widget_instance function in wp-includes/class-wp-customize-widgets.php in WordPress before 4.2.4 does not use a constant-time comparison for widgets, which allows remote attackers to conduct a timing side-channel attack by measuring the delay before inequality is calculated.

CVSS v2.0

5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N

EPSS

7.09% chance of exploitation in the next 30 days, 94th percentile

Nuclei

medium

Published

2015-11-09

Updated

2024-08-06

Nuclei templates (1)

• topscoder/nuclei-wordfence-cve/blob/main/nuclei-templates/2015/CVE-2015-5730-wordpress-97…

References

• CVE Record
• NVD entry

Related

• CVE-2015-5729
• CVE-2015-5731
• CVE-2015-5715
• CVE-2015-5732
• CVE-2015-5714
• CVE-2015-5733