CVE-2017-14990

MEDIUM 6.5 CVSS 3.0

Published: October 3, 2017
Last modified: June 17, 2026
NVD status: Modified
Reported by: cve@mitre.org
Weakness: CWE-312
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Description

WordPress 4.8.2 stores cleartext wp_signups.activation_key values (but stores the analogous wp_users.user_activation_key values as hashes), which might make it easier for remote attackers to hijack unactivated user accounts by leveraging database read access (such as access gained through an unspecified SQL injection vulnerability).

Affected WordPress components

WordPress core

Confirmed match

Version 4.8.2

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

n/a n/a — Versions not specified
wordpress wordpress — Version 4.8.2

References

www.securitytracker.com http://www.securitytracker.com/id/1039554 Third Party Advisory, VDB Entry
core.trac.wordpress.org https://core.trac.wordpress.org/ticket/38474 Exploit, Issue Tracking, Third Party Advisory
www.debian.org https://www.debian.org/security/2017/dsa-3997 Third Party Advisory
nvd.nist.gov Official NVD record

WordPress CVEs

Description

Affected WordPress components

Affected products and versions

References