CVE-2014-0165
WordPress before 3.7.2 and 3.8.x before 3.8.2 allows remote authenticated users to publish posts...
WordPress before 3.7.2 and 3.8.x before 3.8.2 allows remote authenticated users to publish posts by leveraging the Contributor role, related to wp-admin/includes/post.php and wp-admin/includes/class-wp-posts-list-table.php.
Exploit likelihood
What each source reports
NVD Score used
WordPress before 3.7.2 and 3.8.x before 3.8.2 allows remote authenticated users to publish posts by leveraging the Contributor role, related to wp-admin/includes/post.php and wp-admin/includes/class-wp-posts-list-table.php.
- Record
CVE-2014-0165- CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:N/I:P/A:N - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
WordPress before 3.7.2 and 3.8.x before 3.8.2 allows remote authenticated users to publish posts by leveraging the Contributor role, related to wp-admin/includes/post.php and wp-admin/includes/class-wp-posts-list-table.php.
- Record
CVE-2014-0165- Updated
- 2026-11-02
EUVDEUVD-2014-0220 No score
WordPress before 3.7.2 and 3.8.x before 3.8.2 allows remote authenticated users to publish posts by leveraging the Contributor role, related to wp-admin/includes/post.php and wp-admin/includes/class-wp-posts-list-table.php.
- Record
EUVD-2014-0220- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-hhj8-hj4j-7q6w No score
WordPress before 3.7.2 and 3.8.x before 3.8.2 allows remote authenticated users to publish posts...
WordPress before 3.7.2 and 3.8.x before 3.8.2 allows remote authenticated users to publish posts by leveraging the Contributor role, related to wp-admin/includes/post.php and wp-admin/includes/class-wp-posts-list-table.php.
- Record
GHSA-hhj8-hj4j-7q6w- Updated
- 2026-11-02
OSV No score
WordPress before 3.7.2 and 3.8.x before 3.8.2 allows remote authenticated users to publish posts by leveraging the Contributor role, related to wp-admin/includes/post.php and wp-admin/includes/class-wp-posts-list-table.php.
- Record
CVE-2014-0165- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-0165 No score
WordPress before 3.7.2 and 3.8.x before 3.8.2 allows remote authenticated users to publish posts by leveraging the Contributor role, related to wp-admin/includes/post.php and wp-admin/includes/class-wp-posts-list-table.php.
- Record
DEBIAN-CVE-2014-0165- Updated
- 2026-11-02
OSVMGASA-2014-0254 No score
Updated wordpress package fixes multiple vulnerabilities
Updated wordpress package fixes security vulnerabilities:
WordPress before 3.7.2 allows remote authenticated users to publish posts by leveraging the Contributor role, related to wp-admin/includes/post.php and wp-admin/includes/class-wp-posts-list-table.php (CVE-2014-0165).
The wp_validate_auth_cookie function in wp-includes/pluggable.php in WordPress before 3.7.2 does not properly determine the validity of authentication cookies, which makes it easier for remote attackers to obtain access via a forged cookie (CVE-2014-0166).
The wordpress package has been updated to version 3.9.1, fixing these and other issues.
- Record
MGASA-2014-0254- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-0165 No score
WordPress before 3.7.2 and 3.8.x before 3.8.2 allows remote authenticated users to publish posts by leveraging the Contributor role, related to wp-admin/includes/post.php and wp-admin/includes/class-wp-posts-list-table.php.
- Record
UBUNTU-CVE-2014-0165- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
wordpressDebian:12 |
before 3.8.2+dfsg-1 | 3.8.2+dfsg-1 |
wordpressDebian:13 |
before 3.8.2+dfsg-1 | 3.8.2+dfsg-1 |
wordpressDebian:14 |
before 3.8.2+dfsg-1 | 3.8.2+dfsg-1 |
wordpressDebian:6.0 |
before 3.6.1+dfsg-1~deb6u2, plus listed versions 3.0.4+dfsg-13.0.5+dfsg-0+squeeze13.0.5+dfsg-13.2.1+dfsg-13.2.1+dfsg-2 Show 18 moreShow less3.2.1+dfsg-33.3+dfsg-13.3.1+dfsg-13.3.2+dfsg-13.3.2+dfsg-1~squeeze13.4+dfsg-13.4+dfsg-23.4+dfsg-33.4.1+dfsg-13.4.2+dfsg-13.5+dfsg-13.5.1+dfsg-13.5.1+dfsg-23.5.2+dfsg-13.5.2+dfsg-1~deb6u13.5.2+dfsg-1~deb7u13.6+dfsg-13.6.1+dfsg-1~deb6u1 |
3.6.1+dfsg-1~deb6u2 |
wordpressDebian:7 |
before 3.6.1+dfsg-1~deb7u2, plus listed versions 3.5.1+dfsg-23.5.2+dfsg-13.5.2+dfsg-1~deb6u13.5.2+dfsg-1~deb7u13.6+dfsg-1 Show 10 moreShow less3.6.1+dfsg-1~deb6u13.6.1+dfsg-1~deb6u23.6.1+dfsg-1~deb6u33.6.1+dfsg-1~deb6u43.6.1+dfsg-1~deb6u53.6.1+dfsg-1~deb6u63.6.1+dfsg-1~deb6u73.6.1+dfsg-1~deb6u83.6.1+dfsg-1~deb6u93.6.1+dfsg-1~deb7u1 |
3.6.1+dfsg-1~deb7u2 |
wordpressMageia:3 |
before 3.9.1-1.mga3 | 3.9.1-1.mga3 |
wordpressMageia:4 |
before 3.9.1-1.mga4 | 3.9.1-1.mga4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-0165 is a medium vulnerability (CVSS 4.0) in Wordpress, published April 9, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.43%, the 84th percentile. Fixed in wordpress 3.8.2+dfsg-1.
References
codex.wordpress.org/Version_3.7.2
core.trac.wordpress.org/changeset/27976
debian.org/security/2014/dsa-2901
bugzilla.redhat.com/show_bug.cgi?id=1085866
nvd.nist.gov/vuln/detail/CVE-2014-0165