Description

WordPress is prone to a Denial of Service vulnerability which can be exploited by malicious people to cause the affected website to consume memory and CPU resources, thus denying service to legitimate users. WordPress versions prior to 3.7.4, 3.8.4 and 3.9.2 are vulnerable.

Remediation

Update to WordPress version 3.7.4, 3.8.4, 3.9.2 or latest

References

http://www.breaksec.com/?p=6362

http://codex.wordpress.org/Version_3.7.4

http://codex.wordpress.org/Version_3.8.4

http://codex.wordpress.org/Version_3.9.2

Related Vulnerabilities

axios Insertion of Sensitive Information Into Sent Data Vulnerability (CVE-2026-44487)

Apache HTTP Server CVE-2012-0053 Vulnerability (CVE-2012-0053)

WordPress Plugin SiteGuard WP Information Disclosure (1.7.6)

WordPress Plugin InJob-Multi features for recruitment WordPress Theme (Themeforest) Cross-Site Scripting (3.3.7)

WordPress 4.8.x Arbitrary File Deletion Vulnerability (4.8 - 4.8.6)

Severity

High

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Tags

Missing Update Denial Of Service CWE-399 CVE-2014-5265