Unrated severityNVD Advisory· Published Nov 25, 2014· Updated Jun 17, 2026
CVE-2014-9033
CVE-2014-9033
Description
Cross-site request forgery (CSRF) vulnerability in wp-login.php in WordPress 3.7.4, 3.8.4, 3.9.2, and 4.0 allows remote attackers to hijack the authentication of arbitrary users for requests that reset passwords.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
5cpe:2.3:a:wordpress:wordpress:3.7.4:*:*:*:*:*:*:*+ 4 more
- cpe:2.3:a:wordpress:wordpress:3.7.4:*:*:*:*:*:*:*
- cpe:2.3:a:wordpress:wordpress:3.8.4:*:*:*:*:*:*:*
- cpe:2.3:a:wordpress:wordpress:3.9.2:*:*:*:*:*:*:*
- cpe:2.3:a:wordpress:wordpress:4.0:*:*:*:*:*:*:*
- (no CPE)range: 3.7.4, 3.8.4, 3.9.2, 4.0
Patches
Vulnerability mechanics
References
7- wordpress.org/news/2014/11/wordpress-4-0-1/nvdPatchVendor Advisory
- core.trac.wordpress.org/changeset/30418nvdVendor Advisory
- advisories.mageia.org/MGASA-2014-0493.htmlnvd
- openwall.com/lists/oss-security/2014/11/25/12nvd
- www.debian.org/security/2014/dsa-3085nvd
- www.mandriva.com/security/advisoriesnvd
- www.securitytracker.com/id/1031243nvd
News mentions
0No linked articles in our index yet.