{"id":"CVE-2014-9037","aliases":["DEBIAN-CVE-2014-9037","DLA-236-1","DSA-3085-1","EUVD-2014-8865","GHSA-f6m5-cxjc-8qwq","MGASA-2014-0493"],"status":"published","title":"WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow...","description":"WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to obtain access to an account idle since 2008 by leveraging an improper PHP dynamic type comparison for an MD5 hash.","severity":{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.0261,"percentile":0.855,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-310"],"published":"2014-11-25T23:00:00Z","modified":"2026-10-23T15:47:30Z","fixes":[{"ecosystem":"Debian:12","package":"wordpress","fixed_in":["4.0.1+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"wordpress","fixed_in":["4.0.1+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"wordpress","fixed_in":["4.0.1+dfsg-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.1+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.1+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.1+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.1+dfsg-1~deb6u6"}]}],"versions":["3.0.4+dfsg-1","3.0.5+dfsg-0+squeeze1","3.0.5+dfsg-1","3.2.1+dfsg-1","3.2.1+dfsg-2","3.2.1+dfsg-3","3.3+dfsg-1","3.3.1+dfsg-1","3.3.2+dfsg-1","3.3.2+dfsg-1~squeeze1","3.4+dfsg-1","3.4+dfsg-2","3.4+dfsg-3","3.4.1+dfsg-1","3.4.2+dfsg-1","3.5+dfsg-1","3.5.1+dfsg-1","3.5.1+dfsg-2","3.5.2+dfsg-1","3.5.2+dfsg-1~deb6u1","3.5.2+dfsg-1~deb7u1","3.6+dfsg-1","3.6.1+dfsg-1~deb6u1","3.6.1+dfsg-1~deb6u2","3.6.1+dfsg-1~deb6u3","3.6.1+dfsg-1~deb6u4","3.6.1+dfsg-1~deb6u5"],"bundled":11},{"source":"osv","ecosystem":"Debian:7","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.1+dfsg-1~deb7u5"}]}],"versions":["3.5.1+dfsg-2","3.5.2+dfsg-1","3.5.2+dfsg-1~deb6u1","3.5.2+dfsg-1~deb7u1","3.6+dfsg-1","3.6.1+dfsg-1~deb6u1","3.6.1+dfsg-1~deb6u2","3.6.1+dfsg-1~deb6u3","3.6.1+dfsg-1~deb6u4","3.6.1+dfsg-1~deb6u5","3.6.1+dfsg-1~deb6u6","3.6.1+dfsg-1~deb6u7","3.6.1+dfsg-1~deb6u8","3.6.1+dfsg-1~deb6u9","3.6.1+dfsg-1~deb7u1","3.6.1+dfsg-1~deb7u2","3.6.1+dfsg-1~deb7u3","3.6.1+dfsg-1~deb7u4"],"bundled":8},{"source":"osv","ecosystem":"Mageia:3","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.3-1.mga3"}]}],"bundled":9},{"source":"osv","ecosystem":"Mageia:4","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.3-1.mga4"}]}],"bundled":9}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"mageia_project","product":"mageia"},{"vendor":"wordpress","product":"wordpress"}],"references":[{"url":"http://www.debian.org/security/2014/dsa-3085","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"http://openwall.com/lists/oss-security/2014/11/25/12","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://advisories.mageia.org/MGASA-2014-0493.html","tags":["x_refsource_CONFIRM","x_transferred","advisory"]},{"url":"http://www.securitytracker.com/id/1031243","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","web"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2014:233","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred","advisory"]},{"url":"https://wordpress.org/news/2014/11/wordpress-4-0-1/","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-9037"},{"url":"https://wordpress.org/news/2014/11/wordpress-4-0-1"},{"url":"https://github.com/advisories/GHSA-f6m5-cxjc-8qwq"},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-9037","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2014-0493.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=14625","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2014-9037","description":"WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to obtain access to an account idle since 2008 by leveraging an improper PHP dynamic type comparison for an MD5 hash.","status":"published","published":"2014-11-25T23:00:00Z","modified":"2024-08-06T13:33:13.51Z","updated_at":"2026-11-02T14:33:42.54191Z"}],"euvd":[{"id":"EUVD-2014-8865","description":"WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to obtain access to an account idle since 2008 by leveraging an improper PHP dynamic type comparison for an MD5 hash.","status":"published","published":"2014-11-25T23:00:00Z","modified":"2024-08-06T13:33:13Z","updated_at":"2026-11-03T01:56:50.141542Z"}],"ghsa":[{"id":"GHSA-f6m5-cxjc-8qwq","title":"WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow...","description":"WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to obtain access to an account idle since 2008 by leveraging an improper PHP dynamic type comparison for an MD5 hash.","status":"published","published":"2022-05-17T03:52:13Z","modified":"2025-04-12T12:43:23Z","updated_at":"2026-11-02T15:01:19.873405Z"}],"nvd":[{"id":"CVE-2014-9037","description":"WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to obtain access to an account idle since 2008 by leveraging an improper PHP dynamic type comparison for an MD5 hash.","status":"published","published":"2014-11-25T23:59:08.193Z","modified":"2026-06-17T00:17:42.297Z","cvss":[{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-310"],"updated_at":"2026-11-02T14:02:57.304171Z"}],"osv":[{"id":"CVE-2014-9037","description":"WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to obtain access to an account idle since 2008 by leveraging an improper PHP dynamic type comparison for an MD5 hash.","status":"published","published":"2014-11-25T23:59:08Z","modified":"2026-04-16T06:23:25.863610208Z","updated_at":"2026-11-02T15:44:00.097545Z"},{"id":"DEBIAN-CVE-2014-9037","description":"WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to obtain access to an account idle since 2008 by leveraging an improper PHP dynamic type comparison for an MD5 hash.","status":"published","published":"2014-11-25T23:59:08.193Z","modified":"2026-10-23T15:47:30.925606508Z","updated_at":"2026-11-02T15:45:26.442161Z"},{"id":"DLA-236-1","title":"wordpress - security update","status":"published","published":"2015-06-01T00:00:00Z","modified":"2026-03-09T01:23:07.883089Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"DSA-3085-1","title":"wordpress - security update","status":"published","published":"2014-12-03T00:00:00Z","modified":"2026-03-09T01:17:49.14377Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"MGASA-2014-0493","title":"Updated wordpress package fixes security vulnerabilities","description":"XSS in wptexturize() via comments or posts, exploitable for unauthenticated users (CVE-2014-9031).\n\nXSS in media playlists (CVE-2014-9032).\n\nCSRF in the password reset process (CVE-2014-9033).\n\nDenial of service for giant passwords. The phpass library by Solar Designer\nwas used in both projects without setting a maximum password length, which\ncan lead to CPU exhaustion upon hashing (CVE-2014-9034).\n\nXSS in Press This (CVE-2014-9035).\n\nXSS in HTML filtering of CSS in posts (CVE-2014-9036).\n\nHash comparison vulnerability in old-style MD5-stored passwords\n(CVE-2014-9037).\n\nSSRF: Safe HTTP requests did not sufficiently block the loopback IP address\nspace (CVE-2014-9038).\n\nPreviously an email address change would not invalidate a previous password\nreset email (CVE-2014-9039).\n","status":"published","published":"2014-11-26T17:29:06Z","modified":"2026-04-16T06:24:11.966579605Z","updated_at":"2026-11-02T15:49:39.488462Z"}]}}