WordPress security changelog
CRITICAL CVE-2007-6013 Modified

WordPress component: A security weakness

WordPress component is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

CVE / CNA score 9.8 CVSS · cve@mitre.org
NVD score 9.8 CVSS 3.1 · nvd@nist.gov
Component
WordPress component
Plugin slug
Core
Affected
See vendor advisory
Safe version
See mitigation notes
Published
Nov 19, 2007
Weakness
CWE-327 — Use of a Broken or Risky Cryptographic Algorithm

This CVE was published Nov 19, 2007 and is one of 45 known issues for WordPress core.

What to do

Patch or disable the affected component.

Update WordPress component to a release outside the affected range, or disable and remove it until a fixed version is available.

Source record

Technical description

Wordpress 1.5 through 2.3.1 uses cookie values based on the MD5 hash of a password MD5 hash, which allows attackers to bypass authentication by obtaining the MD5 hash from the user database, then generating the authentication cookie from that hash.

NVD vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Primary and upstream sources