blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2007-6013

CRITICAL 9.8 CVSS 3.1
Published
November 19, 2007
Last modified
June 16, 2026
NVD status
Modified
Reported by
cve@mitre.org
Weakness
CWE-327
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

Wordpress 1.5 through 2.3.1 uses cookie values based on the MD5 hash of a password MD5 hash, which allows attackers to bypass authentication by obtaining the MD5 hash from the user database, then generating the authentication cookie from that hash.

Affected WordPress components

  • WordPress core
    Confirmed match
    From 1.5 (including) to 2.3.1 (including)

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • n/a n/a — Versions not specified
  • wordpress wordpress — From 1.5 (including) to 2.3.1 (including)

References

  • lists.grok.org.uk http://lists.grok.org.uk/pipermail/full-disclosure/2007-November/058576.html Broken Link
  • osvdb.org http://osvdb.org/40801 Broken Link
  • secunia.com http://secunia.com/advisories/27714 Broken Link, Vendor Advisory
  • secunia.com http://secunia.com/advisories/28310 Broken Link, Vendor Advisory
  • securityreason.com http://securityreason.com/securityalert/3375 Broken Link
  • trac.wordpress.org http://trac.wordpress.org/ticket/5367 Exploit, Issue Tracking
  • www.cl.cam.ac.uk http://www.cl.cam.ac.uk/~sjm217/advisories/wordpress-cookie-auth.txt Third Party Advisory
  • www.securityfocus.com http://www.securityfocus.com/archive/1/483927/100/0/threaded Broken Link, Third Party Advisory, VDB Entry
  • www.securitytracker.com http://www.securitytracker.com/id?1018980 Broken Link, Third Party Advisory, VDB Entry
  • www.vupen.com http://www.vupen.com/english/advisories/2007/3941 Broken Link, Vendor Advisory
  • exchange.xforce.ibmcloud.com https://exchange.xforce.ibmcloud.com/vulnerabilities/38578 Third Party Advisory, VDB Entry
  • www.redhat.com https://www.redhat.com/archives/fedora-package-announce/2008-January/msg00079.html Mailing List
  • www.redhat.com https://www.redhat.com/archives/fedora-package-announce/2008-January/msg00098.html Mailing List
  • nvd.nist.gov Official NVD record