blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2014-5034

HIGH 8.8 CVSS 3.0
Published
April 6, 2018
Last modified
June 17, 2026
NVD status
Modified
Reported by
cve@mitre.org
Weakness
CWE-352
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Description

Cross-site request forgery (CSRF) vulnerability in the Brute Force Login Protection module 1.3 for WordPress allows remote attackers to hijack the authentication of unspecified users for requests that have unknown impact via a crafted request to the brute-force-login-protection page to wp-admin/options-general.php.

Affected products and versions

  • n/a n/a — Versions not specified
  • fresh-media brute_force_login_protection — Version 1.3

References

  • github.com https://github.com/0pc0deFR/Exploits/blob/master/CVE-2014-5034/exploit.html Exploit, Third Party Advisory
  • github.com https://github.com/0pc0deFR/wordpress-sploit-framework/blob/master/exploits/Brute_Force_Login_Protection_1_3_Cross_Site_Request_Forgery Exploit, Third Party Advisory
  • nvd.nist.gov Official NVD record