CVE-2014-0165
WordPress before 3.7.2 and 3.8.x before 3.8.2 allows remote authenticated users to publish posts...
CVE-2014-0165 is a medium vulnerability (CVSS 4.0) in Wordpress, published April 9, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.43%, the 84th percentile. Fixed in wordpress 3.8.2+dfsg-1.
- Severity
- 4.0 MediumCVSS 2.0, NVD
- Exploit chance
- 2.43%EPSS, 84th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
3.8.2+dfsg-1wordpress +6 more
Description
WordPress before 3.7.2 and 3.8.x before 3.8.2 allows remote authenticated users to publish posts by leveraging the Contributor role, related to wp-admin/includes/post.php and wp-admin/includes/class-wp-posts-list-table.php.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
wordpressDebian:12 | before 3.8.2+dfsg-1 | 3.8.2+dfsg-1 |
wordpressDebian:13 | before 3.8.2+dfsg-1 | 3.8.2+dfsg-1 |
wordpressDebian:14 | before 3.8.2+dfsg-1 | 3.8.2+dfsg-1 |
wordpressDebian:6.0 From an advisory covering 2 CVEs | before 3.6.1+dfsg-1~deb6u2, plus listed versions 3.0.4+dfsg-13.0.5+dfsg-0+squeeze13.0.5+dfsg-13.2.1+dfsg-13.2.1+dfsg-2 Show 18 moreShow less3.2.1+dfsg-33.3+dfsg-13.3.1+dfsg-13.3.2+dfsg-13.3.2+dfsg-1~squeeze13.4+dfsg-13.4+dfsg-23.4+dfsg-33.4.1+dfsg-13.4.2+dfsg-13.5+dfsg-13.5.1+dfsg-13.5.1+dfsg-23.5.2+dfsg-13.5.2+dfsg-1~deb6u13.5.2+dfsg-1~deb7u13.6+dfsg-13.6.1+dfsg-1~deb6u1 | 3.6.1+dfsg-1~deb6u2 |
wordpressDebian:7 From an advisory covering 2 CVEs | before 3.6.1+dfsg-1~deb7u2, plus listed versions 3.5.1+dfsg-23.5.2+dfsg-13.5.2+dfsg-1~deb6u13.5.2+dfsg-1~deb7u13.6+dfsg-1 Show 10 moreShow less3.6.1+dfsg-1~deb6u13.6.1+dfsg-1~deb6u23.6.1+dfsg-1~deb6u33.6.1+dfsg-1~deb6u43.6.1+dfsg-1~deb6u53.6.1+dfsg-1~deb6u63.6.1+dfsg-1~deb6u73.6.1+dfsg-1~deb6u83.6.1+dfsg-1~deb6u93.6.1+dfsg-1~deb7u1 | 3.6.1+dfsg-1~deb7u2 |
wordpressMageia:3 From an advisory covering 2 CVEs | before 3.9.1-1.mga3 | 3.9.1-1.mga3 |
wordpressMageia:4 From an advisory covering 2 CVEs | before 3.9.1-1.mga4 | 3.9.1-1.mga4 |
What each source reports
NVD Score used
WordPress before 3.7.2 and 3.8.x before 3.8.2 allows remote authenticated users to publish posts by leveraging the Contributor role, related to wp-admin/includes/post.php and wp-admin/includes/class-wp-posts-list-table.php.
- Record
CVE-2014-0165- CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:N/I:P/A:N - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE ListNo score
WordPress before 3.7.2 and 3.8.x before 3.8.2 allows remote authenticated users to publish posts by leveraging the Contributor role, related to wp-admin/includes/post.php and wp-admin/includes/class-wp-posts-list-table.php.
- Record
CVE-2014-0165- Updated
- 2026-11-02
EUVDEUVD-2014-0220No score
WordPress before 3.7.2 and 3.8.x before 3.8.2 allows remote authenticated users to publish posts by leveraging the Contributor role, related to wp-admin/includes/post.php and wp-admin/includes/class-wp-posts-list-table.php.
- Record
EUVD-2014-0220- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-hhj8-hj4j-7q6wNo score
WordPress before 3.7.2 and 3.8.x before 3.8.2 allows remote authenticated users to publish posts...
WordPress before 3.7.2 and 3.8.x before 3.8.2 allows remote authenticated users to publish posts by leveraging the Contributor role, related to wp-admin/includes/post.php and wp-admin/includes/class-wp-posts-list-table.php.
- Record
GHSA-hhj8-hj4j-7q6w- Updated
- 2026-11-02
OSVNo score
WordPress before 3.7.2 and 3.8.x before 3.8.2 allows remote authenticated users to publish posts by leveraging the Contributor role, related to wp-admin/includes/post.php and wp-admin/includes/class-wp-posts-list-table.php.
- Record
CVE-2014-0165- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-0165No score
WordPress before 3.7.2 and 3.8.x before 3.8.2 allows remote authenticated users to publish posts by leveraging the Contributor role, related to wp-admin/includes/post.php and wp-admin/includes/class-wp-posts-list-table.php.
- Record
DEBIAN-CVE-2014-0165- Updated
- 2026-11-02
OSVMGASA-2014-0254No score
Updated wordpress package fixes multiple vulnerabilities
Updated wordpress package fixes security vulnerabilities:
WordPress before 3.7.2 allows remote authenticated users to publish posts by leveraging the Contributor role, related to wp-admin/includes/post.php and wp-admin/includes/class-wp-posts-list-table.php (CVE-2014-0165).
The wp_validate_auth_cookie function in wp-includes/pluggable.php in WordPress before 3.7.2 does not properly determine the validity of authentication cookies, which makes it easier for remote attackers to obtain access via a forged cookie (CVE-2014-0166).
The wordpress package has been updated to version 3.9.1, fixing these and other issues.
- Record
MGASA-2014-0254- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-0165No score
WordPress before 3.7.2 and 3.8.x before 3.8.2 allows remote authenticated users to publish posts by leveraging the Contributor role, related to wp-admin/includes/post.php and wp-admin/includes/class-wp-posts-list-table.php.
- Record
UBUNTU-CVE-2014-0165- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.