CVE-2014-9034
wp-includes/class-phpass.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to cause a...
- Published
- Nov 25, 2014
- Updated
- Aug 6, 2024
- Assigning CNA
- mitre
- Evidence observed
- Dec 1, 2014
Primary CVSS
nvd · CVSS 2.0
AV:N/AC:L/Au:N/C:N/I:N/A:PHigh · next 30 days
- Percentile
- 99.7%
- Model date
- Sep 21, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
wp-includes/class-phpass.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to cause a denial of service (CPU consumption) via a long password that is improperly handled during hashing, a similar issue to CVE-2014-9016.
Sources
3- wp_drupal_timing_attackExploit
Python scripts to exploit CVE-2014-9016 and CVE-2014-9034
SECURELI.com · php · Dec 1, 2014
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.