WordPress Multiple Security Vulnerabilities

Bugtraq ID:	66765
Class:	Input Validation Error
CVE:	CVE-2014-0165 CVE-2014-0166
Remote:	Yes
Local:	No
Published:	Apr 08 2014 12:00AM
Updated:	Apr 13 2015 09:26PM
Credit:	Jon Cave, WordPress, edik, Szymon Gruszecki.
Vulnerable:	WordPress WordPress 3.8.1 WordPress WordPress 3.8 Mandriva Business Server 1 X86 64 Mandriva Business Server 1 Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64
Not Vulnerable:	WordPress WordPress 3.8.2

WordPress Multiple Security Vulnerabilities

WordPress is prone to multiple security vulnerabilities.

An attacker can exploit these issues to bypass certain security restrictions, gain unauthorized access, run malicious HTML and script codes, or steal cookie-based authentication credentials. This may aid in further attacks.

WordPress versions prior to 3.8.2 are vulnerable.

WordPress Multiple Security Vulnerabilities

An attacker can exploit these issues using a web browser.

WordPress Multiple Security Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

WordPress Multiple Security Vulnerabilities

References:

• Bug 1085858 - (CVE-2014-0166) CVE-2014-0166 wordpress: authentication bypass via (Red Hat Bugzilla)
  
• Bug 1085866 - (CVE-2014-0165) CVE-2014-0165 wordpress: privilege escalation issu (Red Hat Bugzilla)
  
• WordPress HomePage (WordPress)
  
• WordPress 3.8.2 Security Release (WordPress)