WordPress 3.4.2 - Session Cookie Invalidation
Summary
CVE-2012-5868: WordPress 3.4.2 does not invalidate a wordpress_sec session cookie upon an administrator's logout action, which makes it easier for remote attackers to discover valid session identifiers via a brute-force attack, or modi... Affects wordpress versions 5.7.1+dfsg1-2 – 6.8.1+dfsg1-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
WordPress is a popular content management system (CMS) used for creating websites and blogs. It provides a user-friendly interface for managing website content, themes, and plugins. WordPress 3.4.2 is a specific version of WordPress that is vulnerable to a session cookie invalidation issue.
Vulnerability Detail
The vulnerability in WordPress 3.4.2 allows an attacker to discover valid session identifiers through a brute-force attack or modify data through a replay attack. When an administrator logs out, the wordpress_sec session cookie is not invalidated, making it possible for an attacker to use the session identifier to gain unauthorized access or manipulate data on the website.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. Upgrading to a patched version of WordPress is the recommended solution.
Conclusion
WordPress 3.4.2 is vulnerable to a session cookie invalidation issue, which can lead to unauthorized access or data manipulation on a website. It is crucial to upgrade to a patched version of WordPress to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for wordpress →
FAQ
This vulnerability allows an attacker to gain unauthorized access to a WordPress website or manipulate data on the website.
Yes, this vulnerability can be exploited remotely by an attacker.
There may be known exploits for this vulnerability, so it is important to upgrade to a patched version of WordPress as soon as possible.
No, only WordPress 3.4.2 is known to be affected by this vulnerability.
Yes, upgrading to a newer version of WordPress that includes a patch for this vulnerability will fix the issue.
Related vulnerabilities
Recent vulnerabilities recorded for wordpress.
