CVE-2014-9037
WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow...
CVE-2014-9037 is a medium vulnerability (CVSS 6.8) in Wordpress, published November 25, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.61%, the 85th percentile. Fixed in wordpress 4.0.1+dfsg-1.
- Severity
- 6.8 MediumCVSS 2.0, NVD
- Exploit chance
- 2.61%EPSS, 85th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
4.0.1+dfsg-1wordpress +6 more
Description
WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to obtain access to an account idle since 2008 by leveraging an improper PHP dynamic type comparison for an MD5 hash.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
wordpressDebian:12 | before 4.0.1+dfsg-1 | 4.0.1+dfsg-1 |
wordpressDebian:13 | before 4.0.1+dfsg-1 | 4.0.1+dfsg-1 |
wordpressDebian:14 | before 4.0.1+dfsg-1 | 4.0.1+dfsg-1 |
wordpressDebian:6.0 From an advisory covering 11 CVEs | before 3.6.1+dfsg-1~deb6u6, plus listed versions 3.0.4+dfsg-13.0.5+dfsg-0+squeeze13.0.5+dfsg-13.2.1+dfsg-13.2.1+dfsg-2 Show 22 moreShow less3.2.1+dfsg-33.3+dfsg-13.3.1+dfsg-13.3.2+dfsg-13.3.2+dfsg-1~squeeze13.4+dfsg-13.4+dfsg-23.4+dfsg-33.4.1+dfsg-13.4.2+dfsg-13.5+dfsg-13.5.1+dfsg-13.5.1+dfsg-23.5.2+dfsg-13.5.2+dfsg-1~deb6u13.5.2+dfsg-1~deb7u13.6+dfsg-13.6.1+dfsg-1~deb6u13.6.1+dfsg-1~deb6u23.6.1+dfsg-1~deb6u33.6.1+dfsg-1~deb6u43.6.1+dfsg-1~deb6u5 | 3.6.1+dfsg-1~deb6u6 |
wordpressDebian:7 From an advisory covering 8 CVEs | before 3.6.1+dfsg-1~deb7u5, plus listed versions 3.5.1+dfsg-23.5.2+dfsg-13.5.2+dfsg-1~deb6u13.5.2+dfsg-1~deb7u13.6+dfsg-1 Show 13 moreShow less3.6.1+dfsg-1~deb6u13.6.1+dfsg-1~deb6u23.6.1+dfsg-1~deb6u33.6.1+dfsg-1~deb6u43.6.1+dfsg-1~deb6u53.6.1+dfsg-1~deb6u63.6.1+dfsg-1~deb6u73.6.1+dfsg-1~deb6u83.6.1+dfsg-1~deb6u93.6.1+dfsg-1~deb7u13.6.1+dfsg-1~deb7u23.6.1+dfsg-1~deb7u33.6.1+dfsg-1~deb7u4 | 3.6.1+dfsg-1~deb7u5 |
wordpressMageia:3 From an advisory covering 9 CVEs | before 3.9.3-1.mga3 | 3.9.3-1.mga3 |
wordpressMageia:4 From an advisory covering 9 CVEs | before 3.9.3-1.mga4 | 3.9.3-1.mga4 |
What each source reports
NVD Score used
WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to obtain access to an account idle since 2008 by leveraging an improper PHP dynamic type comparison for an MD5 hash.
- Record
CVE-2014-9037- CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-310
- Updated
- 2026-11-02
CVE ListNo score
WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to obtain access to an account idle since 2008 by leveraging an improper PHP dynamic type comparison for an MD5 hash.
- Record
CVE-2014-9037- Updated
- 2026-11-02
EUVDEUVD-2014-8865No score
WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to obtain access to an account idle since 2008 by leveraging an improper PHP dynamic type comparison for an MD5 hash.
- Record
EUVD-2014-8865- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-f6m5-cxjc-8qwqNo score
WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow...
WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to obtain access to an account idle since 2008 by leveraging an improper PHP dynamic type comparison for an MD5 hash.
- Record
GHSA-f6m5-cxjc-8qwq- Updated
- 2026-11-02
OSVNo score
WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to obtain access to an account idle since 2008 by leveraging an improper PHP dynamic type comparison for an MD5 hash.
- Record
CVE-2014-9037- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-9037No score
WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to obtain access to an account idle since 2008 by leveraging an improper PHP dynamic type comparison for an MD5 hash.
- Record
DEBIAN-CVE-2014-9037- Updated
- 2026-11-02
OSVMGASA-2014-0493No score
Updated wordpress package fixes security vulnerabilities
XSS in wptexturize() via comments or posts, exploitable for unauthenticated users (CVE-2014-9031).
XSS in media playlists (CVE-2014-9032).
CSRF in the password reset process (CVE-2014-9033).
Denial of service for giant passwords. The phpass library by Solar Designer was used in both projects without setting a maximum password length, which can lead to CPU exhaustion upon hashing (CVE-2014-9034).
XSS in Press This (CVE-2014-9035).
XSS in HTML filtering of CSS in posts (CVE-2014-9036).
Hash comparison vulnerability in old-style MD5-stored passwords (CVE-2014-9037).
SSRF: Safe HTTP requests did not sufficiently block the loopback IP address space (CVE-2014-9038).
Previously an email address change would not invalidate a previous password reset email (CVE-2014-9039).
- Record
MGASA-2014-0493- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.