CVEvulnerability
CVE-2014-5034
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2018-04-06
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 8.8 HIGH — CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-352
Description
Cross-site request forgery (CSRF) vulnerability in the Brute Force Login Protection module 1.3 for WordPress allows remote attackers to hijack the authentication of unspecified users for requests that have unknown impact via a crafted request to the brute-force-login-protection page to wp-admin/options-general.php.
Affected configurations
• fresh-media brute force login protection 1.3
Related
Weakness · CWE (1)
- CWE-352 Cross-Site Request Forgery weakness
References
- https://github.com/0pc0deFR/Exploits/blob/master/CVE-2014-5034/exploit.html Exploit, Third Party Advisory
- https://github.com/0pc0deFR/wordpress-sploit-framework/blob/master/exploits/Brute_Force_Login_Protection_1_3_Cross_Site_Request_Forgery Exploit, Third Party Advisory
- https://github.com/0pc0deFR/Exploits/blob/master/CVE-2014-5034/exploit.html Exploit, Third Party Advisory
- https://github.com/0pc0deFR/wordpress-sploit-framework/blob/master/exploits/Brute_Force_Login_Protection_1_3_Cross_Site_Request_Forgery Exploit, Third Party Advisory