Unrated severityNVD Advisory· Published Aug 18, 2014· Updated Jun 17, 2026
CVE-2014-5204
CVE-2014-5204
Description
wp-includes/pluggable.php in WordPress before 3.9.2 rejects invalid CSRF nonces with a different timing depending on which characters in the nonce are incorrect, which makes it easier for remote attackers to bypass a CSRF protection mechanism via a brute-force attack.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
4cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*range: <=3.9.1
- cpe:2.3:a:wordpress:wordpress:3.9.0:*:*:*:*:*:*:*
- (no CPE)range: <3.9.2
Patches
Vulnerability mechanics
References
4News mentions
0No linked articles in our index yet.