{"id":"CVE-2014-0166","aliases":["DEBIAN-CVE-2014-0166","DSA-2901-1","EUVD-2014-0221","GHSA-jg4j-hqh7-5qcx","MGASA-2014-0254","UBUNTU-CVE-2014-0166"],"status":"published","title":"The wp_validate_auth_cookie function in wp-includes/pluggable.php in WordPress before 3.7.2 and 3...","description":"The wp_validate_auth_cookie function in wp-includes/pluggable.php in WordPress before 3.7.2 and 3.8.x before 3.8.2 does not properly determine the validity of authentication cookies, which makes it easier for remote attackers to obtain access via a forged cookie.","severity":{"version":"2.0","score":6.4,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.09173,"percentile":0.95359,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-287"],"published":"2014-04-09T23:00:00Z","modified":"2026-10-23T15:47:33Z","exploits":[{"source":"pocgithub","id":"Ettack/POC-CVE-2014-0166","title":"Ettack/POC-CVE-2014-0166","date":"2014-04-26","url":"https://github.com/Ettack/POC-CVE-2014-0166"}],"fixes":[{"ecosystem":"Debian:12","package":"wordpress","fixed_in":["3.8.2+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"wordpress","fixed_in":["3.8.2+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"wordpress","fixed_in":["3.8.2+dfsg-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.2+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.2+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.2+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.1+dfsg-1~deb6u2"}]}],"versions":["3.0.4+dfsg-1","3.0.5+dfsg-0+squeeze1","3.0.5+dfsg-1","3.2.1+dfsg-1","3.2.1+dfsg-2","3.2.1+dfsg-3","3.3+dfsg-1","3.3.1+dfsg-1","3.3.2+dfsg-1","3.3.2+dfsg-1~squeeze1","3.4+dfsg-1","3.4+dfsg-2","3.4+dfsg-3","3.4.1+dfsg-1","3.4.2+dfsg-1","3.5+dfsg-1","3.5.1+dfsg-1","3.5.1+dfsg-2","3.5.2+dfsg-1","3.5.2+dfsg-1~deb6u1","3.5.2+dfsg-1~deb7u1","3.6+dfsg-1","3.6.1+dfsg-1~deb6u1"],"bundled":2},{"source":"osv","ecosystem":"Debian:7","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.1+dfsg-1~deb7u2"}]}],"versions":["3.5.1+dfsg-2","3.5.2+dfsg-1","3.5.2+dfsg-1~deb6u1","3.5.2+dfsg-1~deb7u1","3.6+dfsg-1","3.6.1+dfsg-1~deb6u1","3.6.1+dfsg-1~deb6u2","3.6.1+dfsg-1~deb6u3","3.6.1+dfsg-1~deb6u4","3.6.1+dfsg-1~deb6u5","3.6.1+dfsg-1~deb6u6","3.6.1+dfsg-1~deb6u7","3.6.1+dfsg-1~deb6u8","3.6.1+dfsg-1~deb6u9","3.6.1+dfsg-1~deb7u1"],"bundled":2},{"source":"osv","ecosystem":"Mageia:3","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.1-1.mga3"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:4","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.1-1.mga4"}]}],"bundled":2}],"products":[{"vendor":"wordpress","product":"wordpress"}],"references":[{"url":"http://codex.wordpress.org/Version_3.7.2","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1085858","tags":["x_refsource_CONFIRM","x_transferred","report"]},{"url":"http://codex.wordpress.org/Version_3.8.2","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"http://www.debian.org/security/2014/dsa-2901","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"http://core.trac.wordpress.org/changeset/28054","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0166"},{"url":"https://github.com/advisories/GHSA-jg4j-hqh7-5qcx"},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-0166","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2014-0254.html","tags":["advisory"]},{"url":"http://www.mandriva.com/en/support/security/advisories/mbs1/MDVSA-2014:103/","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=13184","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-0166","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0166","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2014-0166","description":"The wp_validate_auth_cookie function in wp-includes/pluggable.php in WordPress before 3.7.2 and 3.8.x before 3.8.2 does not properly determine the validity of authentication cookies, which makes it easier for remote attackers to obtain access via a forged cookie.","status":"published","published":"2014-04-09T23:00:00Z","modified":"2024-08-06T09:05:39.053Z","updated_at":"2026-11-02T14:33:47.330011Z"}],"euvd":[{"id":"EUVD-2014-0221","description":"The wp_validate_auth_cookie function in wp-includes/pluggable.php in WordPress before 3.7.2 and 3.8.x before 3.8.2 does not properly determine the validity of authentication cookies, which makes it easier for remote attackers to obtain access via a forged cookie.","status":"published","published":"2014-04-09T23:00:00Z","modified":"2024-08-06T09:05:39Z","updated_at":"2026-11-03T01:57:22.468358Z"}],"ghsa":[{"id":"GHSA-jg4j-hqh7-5qcx","title":"The wp_validate_auth_cookie function in wp-includes/pluggable.php in WordPress before 3.7.2 and 3...","description":"The wp_validate_auth_cookie function in wp-includes/pluggable.php in WordPress before 3.7.2 and 3.8.x before 3.8.2 does not properly determine the validity of authentication cookies, which makes it easier for remote attackers to obtain access via a forged cookie.","status":"published","published":"2022-05-17T00:13:54Z","modified":"2023-02-03T05:01:17Z","cwes":["CWE-287"],"updated_at":"2026-11-02T14:52:56.600383Z"}],"nvd":[{"id":"CVE-2014-0166","description":"The wp_validate_auth_cookie function in wp-includes/pluggable.php in WordPress before 3.7.2 and 3.8.x before 3.8.2 does not properly determine the validity of authentication cookies, which makes it easier for remote attackers to obtain access via a forged cookie.","status":"published","published":"2014-04-10T00:55:09.53Z","modified":"2026-06-17T00:02:25.513Z","cvss":[{"version":"2.0","score":6.4,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:02:53.710973Z"}],"osv":[{"id":"CVE-2014-0166","description":"The wp_validate_auth_cookie function in wp-includes/pluggable.php in WordPress before 3.7.2 and 3.8.x before 3.8.2 does not properly determine the validity of authentication cookies, which makes it easier for remote attackers to obtain access via a forged cookie.","status":"published","published":"2014-04-10T00:55:09Z","modified":"2026-04-16T06:24:23.049369301Z","updated_at":"2026-11-02T15:43:59.361892Z"},{"id":"DEBIAN-CVE-2014-0166","description":"The wp_validate_auth_cookie function in wp-includes/pluggable.php in WordPress before 3.7.2 and 3.8.x before 3.8.2 does not properly determine the validity of authentication cookies, which makes it easier for remote attackers to obtain access via a forged cookie.","status":"published","published":"2014-04-10T00:55:09.53Z","modified":"2026-10-23T15:47:33.892545559Z","updated_at":"2026-11-02T15:45:25.819707Z"},{"id":"DSA-2901-1","title":"wordpress - security update","status":"published","published":"2014-04-12T00:00:00Z","modified":"2026-03-09T01:20:44.610398Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"MGASA-2014-0254","title":"Updated wordpress package fixes multiple vulnerabilities","description":"Updated wordpress package fixes security vulnerabilities:\n\nWordPress before 3.7.2 allows remote authenticated users to publish posts\nby leveraging the Contributor role, related to wp-admin/includes/post.php\nand wp-admin/includes/class-wp-posts-list-table.php (CVE-2014-0165).\n\nThe wp_validate_auth_cookie function in wp-includes/pluggable.php in\nWordPress before 3.7.2 does not properly determine the validity of\nauthentication cookies, which makes it easier for remote attackers to\nobtain access via a forged cookie (CVE-2014-0166).\n\nThe wordpress package has been updated to version 3.9.1, fixing these and\nother issues.\n","status":"published","published":"2014-06-06T10:27:48Z","modified":"2026-04-16T06:24:04.106905846Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"UBUNTU-CVE-2014-0166","description":"The wp_validate_auth_cookie function in wp-includes/pluggable.php in WordPress before 3.7.2 and 3.8.x before 3.8.2 does not properly determine the validity of authentication cookies, which makes it easier for remote attackers to obtain access via a forged cookie.","status":"withdrawn","published":"2014-04-10T00:55:00Z","modified":"2025-07-16T08:10:52.490319Z","updated_at":"2026-11-02T15:54:07.855521Z"}]}}