685
VMScore

CVE-2012-1936

Published: 03/05/2012 Updated: 14/12/2017
CVSS v2 Base Score: 6.8 | Impact Score: 6.4 | Exploitability Score: 8.6
VMScore: 685
Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

Vulnerability Summary

** DISPUTED ** The wp_create_nonce function in wp-includes/pluggable.php in WordPress 3.3.1 and previous versions associates a nonce with a user account instead of a user session, which might make it easier for remote malicious users to conduct cross-site request forgery (CSRF) attacks on specific actions and objects by sniffing the network, as demonstrated by attacks against the wp-admin/admin-ajax.php and wp-admin/user-new.php scripts. NOTE: the vendor reportedly disputes the significance of this issue because wp_create_nonce operates as intended, even if it is arguably inconsistent with certain CSRF protection details advocated by external organizations.

Most Upvoted Vulmon Research Post

There is no Researcher post for this vulnerability
Would you like to share something about it? Sign up now to share your knowledge with the community.
Vulnerable Product Search on Vulmon Subscribe to Product

wordpress wordpress 3.0.3

wordpress wordpress 3.0.1

wordpress wordpress 3.1.4

wordpress wordpress 3.2

wordpress wordpress 2.3.1

wordpress wordpress 2.7

wordpress wordpress 2.8.4

wordpress wordpress 2.9.2

wordpress wordpress 2.3.2

wordpress wordpress 2.0

wordpress wordpress 2.0.7

wordpress wordpress 2.1

wordpress wordpress 2.6

wordpress wordpress 2.2.2

wordpress wordpress 2.5

wordpress wordpress 1.5.1

wordpress wordpress 1.2.1

wordpress wordpress 1.5.1.3

wordpress wordpress 1.5.2

wordpress wordpress 1.3.2

wordpress wordpress 3.1.1

wordpress wordpress 3.1

wordpress wordpress 3.0

wordpress wordpress 3.2.1

wordpress wordpress 2.8

wordpress wordpress 2.0.9

wordpress wordpress 2.3

wordpress wordpress 2.6.3

wordpress wordpress 2.2

wordpress wordpress 2.2.1

wordpress wordpress 2.0.5

wordpress wordpress 2.0.6

wordpress wordpress 2.8.6

wordpress wordpress 2.6.1

wordpress wordpress 1.5.1.1

wordpress wordpress 1.5

wordpress wordpress 1.0.1

wordpress wordpress 1.5.1.2

wordpress wordpress 1.1.1

wordpress wordpress 1.3.3

wordpress wordpress 1.3

wordpress wordpress

wordpress wordpress 3.3

wordpress wordpress 3.0.2

wordpress wordpress 2.0.11

wordpress wordpress 2.6.2

wordpress wordpress 2.8.3

wordpress wordpress 2.8.5

wordpress wordpress 2.9

wordpress wordpress 2.9.1

wordpress wordpress 2.6.5

wordpress wordpress 2.0.1

wordpress wordpress 2.0.10

wordpress wordpress 2.1.1

wordpress wordpress 2.1.2

wordpress wordpress 2.9.1.1

wordpress wordpress 2.8.5.1

wordpress wordpress 1.2.2

wordpress wordpress 1.0.2

wordpress wordpress 1.2.5

wordpress wordpress 3.1.3

wordpress wordpress 3.1.2

wordpress wordpress 3.0.5

wordpress wordpress 3.0.4

wordpress wordpress 3.0.6

wordpress wordpress 2.2.3

wordpress wordpress 2.0.8

wordpress wordpress 2.8.1

wordpress wordpress 2.8.2

wordpress wordpress 2.7.1

wordpress wordpress 2.1.3

wordpress wordpress 2.0.2

wordpress wordpress 2.0.4

wordpress wordpress 2.5.1

wordpress wordpress 2.3.3

wordpress wordpress 2.8.5.2

wordpress wordpress 1.2

wordpress wordpress 1.0

wordpress wordpress 1.2.3

wordpress wordpress 1.2.4

Exploits

+---------------------------------------------------------------------------------------------------------------------------------------------------+ # Exploit Title : Wordpress 331 Multiple CSRF Vulnerabilities # Date : 19-03-2012 # Author : Ivano Binetti (wwwivanobinetticom) # Software link : wor ...

Mailing Lists

WordPress version 331 suffers from multiple cross site request forgery vulnerabilities ...