Description
WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to obtain access to an account idle since 2008 by leveraging an improper PHP dynamic type comparison for an MD5 hash.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- http://www.debian.org/security/2014/dsa-3085 ↗
- http://openwall.com/lists/oss-security/2014/11/25/12 ↗
- http://advisories.mageia.org/MGASA-2014-0493.html ↗
- http://www.securitytracker.com/id/1031243 ↗
- http://www.mandriva.com/security/advisories?name=MDVSA-2014:233 ↗
- https://wordpress.org/news/2014/11/wordpress-4-0-1/ ↗