CVE-2007-6013
Wordpress 1.5 through 2.3.1 uses cookie values based on the MD5 hash of a password MD5 hash,...
Wordpress 1.5 through 2.3.1 uses cookie values based on the MD5 hash of a password MD5 hash, which allows attackers to bypass authentication by obtaining the MD5 hash from the user database, then generating the authentication cookie from that hash.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Wordpress 1.5 through 2.3.1 uses cookie values based on the MD5 hash of a password MD5 hash, which allows attackers to bypass authentication by obtaining the MD5 hash from the user database, then generating the authentication cookie from that hash.
- Record
CVE-2007-6013- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-327
- Updated
- 2026-11-02
CVE List No score
Wordpress 1.5 through 2.3.1 uses cookie values based on the MD5 hash of a password MD5 hash, which allows attackers to bypass authentication by obtaining the MD5 hash from the user database, then generating the authentication cookie from that hash.
- Record
CVE-2007-6013- Updated
- 2026-11-02
EUVDEUVD-2007-5983 No score
Wordpress 1.5 through 2.3.1 uses cookie values based on the MD5 hash of a password MD5 hash, which allows attackers to bypass authentication by obtaining the MD5 hash from the user database, then generating the authentication cookie from that hash.
- Record
EUVD-2007-5983- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5g78-mv2p-rh9c
Wordpress 1.5 through 2.3.1 uses cookie values based on the MD5 hash of a password MD5 hash,...
Wordpress 1.5 through 2.3.1 uses cookie values based on the MD5 hash of a password MD5 hash, which allows attackers to bypass authentication by obtaining the MD5 hash from the user database, then generating the authentication cookie from that hash.
- Record
GHSA-5g78-mv2p-rh9c- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-287, CWE-327
- Updated
- 2026-11-02
OSV
Wordpress 1.5 through 2.3.1 uses cookie values based on the MD5 hash of a password MD5 hash, which allows attackers to bypass authentication by obtaining the MD5 hash from the user database, then generating the authentication cookie from that hash.
- Record
CVE-2007-6013- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2007-6013
Wordpress 1.5 through 2.3.1 uses cookie values based on the MD5 hash of a password MD5 hash, which allows attackers to bypass authentication by obtaining the MD5 hash from the user database, then generating the authentication cookie from that hash.
- Record
DEBIAN-CVE-2007-6013- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| affected, aliases, cwes, facts, references, title | GitHub Advisories, OSV | |
| first indexed | CVE List, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2007-6013 is a critical vulnerability (CVSS 9.8) in Wordpress, published November 19, 2007. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.28%, the 88th percentile. Fixed in wordpress 2.5.0-1.
References
lists.grok.org.uk/pipermail/full-disclosure/2007-November/058576.html
redhat.com/archives/fedora-package-announce/2008-January/msg00098.html
cl.cam.ac.uk/~sjm217/advisories/wordpress-cookie-auth.txt
trac.wordpress.org/ticket/5367
securityreason.com/securityalert/3375
securityfocus.com/archive/1/483927/100/0/threaded
Show 10 moreShow less
vupen.com/english/advisories/2007/3941
exchange.xforce.ibmcloud.com/vulnerabilities/38578
secunia.com/advisories/28310
securitytracker.com/id?1018980
osvdb.org/40801
nvd.nist.gov/vuln/detail/CVE-2007-6013
github.com/advisories/GHSA-5g78-mv2p-rh9c
security-tracker.debian.org/tracker/CVE-2007-6013