Medium severity6.5NVD Advisory· Published Oct 3, 2017· Updated May 13, 2026
CVE-2017-14990
CVE-2017-14990
Description
WordPress 4.8.2 stores cleartext wp_signups.activation_key values (but stores the analogous wp_users.user_activation_key values as hashes), which might make it easier for remote attackers to hijack unactivated user accounts by leveraging database read access (such as access gained through an unspecified SQL injection vulnerability).
Affected products
3- cpe:2.3:a:wordpress:wordpress:4.8.2:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
3- core.trac.wordpress.org/ticket/38474nvdExploitIssue TrackingThird Party Advisory
- www.securitytracker.com/id/1039554nvdThird Party AdvisoryVDB Entry
- www.debian.org/security/2017/dsa-3997nvdThird Party Advisory
News mentions
0No linked articles in our index yet.