Description

WordPress 4.8.2 stores cleartext wp_signups.activation_key values (but stores the analogous wp_users.user_activation_key values as hashes), which might make it easier for remote attackers to hijack unactivated user accounts by leveraging database read access (such as access gained through an unspecified SQL injection vulnerability).

Remediation

References

CVE-2017-14990

Related Vulnerabilities

WordPress Plugin Advanced Dynamic Pricing for WooCommerce Multiple Vulnerabilities (4.1.5)

phpList Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-23192)

WordPress Plugin Premium Addons for Elementor Security Bypass (4.5.1)

Internet Information Services Other Vulnerability (CVE-2000-0025)

XWiki Allocation of Resources Without Limits or Throttling Vulnerability (CVE-2022-41932)

Severity

Medium

Classification

CVE-2017-14990 CWE-312 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Tags

Missing Update Known Vulnerabilities