Unrated severityNVD Advisory· Published Nov 25, 2014· Updated May 6, 2026
CVE-2014-9039
CVE-2014-9039
Description
wp-login.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to reset passwords by leveraging access to an e-mail account that received a password-reset message.
Affected products
14cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*+ 9 more
- cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*range: <=3.7.4
- cpe:2.3:a:wordpress:wordpress:3.8:*:*:*:*:*:*:*
- cpe:2.3:a:wordpress:wordpress:3.8.1:*:*:*:*:*:*:*
- cpe:2.3:a:wordpress:wordpress:3.8.2:*:*:*:*:*:*:*
- cpe:2.3:a:wordpress:wordpress:3.8.3:*:*:*:*:*:*:*
- cpe:2.3:a:wordpress:wordpress:3.8.4:*:*:*:*:*:*:*
- cpe:2.3:a:wordpress:wordpress:3.9:*:*:*:*:*:*:*
- cpe:2.3:a:wordpress:wordpress:3.9.1:*:*:*:*:*:*:*
- cpe:2.3:a:wordpress:wordpress:3.9.2:*:*:*:*:*:*:*
- cpe:2.3:a:wordpress:wordpress:4.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:mageia_project:mageia:3:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:mageia_project:mageia:3:*:*:*:*:*:*:*
- cpe:2.3:o:mageia_project:mageia:4:*:*:*:*:*:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
7- wordpress.org/news/2014/11/wordpress-4-0-1/nvdPatchVendor Advisory
- core.trac.wordpress.org/changeset/30431nvdVendor Advisory
- advisories.mageia.org/MGASA-2014-0493.htmlnvd
- openwall.com/lists/oss-security/2014/11/25/12nvd
- www.debian.org/security/2014/dsa-3085nvd
- www.mandriva.com/security/advisoriesnvd
- www.securitytracker.com/id/1031243nvd
News mentions
0No linked articles in our index yet.