CVE-2014-9039

Published: Nov 25, 2014Modified: May 6, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

wp-login.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to reset passwords by leveraging access to an e-mail account that received a password-reset message.

Affected (14)

Products: Debian: Debian Linux · Mageia Project: Mageia · Wordpress: Wordpress

1 product

1 product

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 7.0
Debian Debian Linux	Version 8.0

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Mageia Project Mageia	Version 3
Mageia Project Mageia	Version 4

Configuration C

10 vulnerable

Vulnerable Software	Affected Versions
Wordpress Wordpress	Up to 3.7.4
Wordpress Wordpress	Version 3.8.1
Wordpress Wordpress	Version 3.8.2
Wordpress Wordpress	Version 3.8.3
Wordpress Wordpress	Version 3.8.4
Wordpress Wordpress	Version 3.8
Wordpress Wordpress	Version 3.9.1
Wordpress Wordpress	Version 3.9.2
Wordpress Wordpress	Version 3.9
Wordpress Wordpress	Version 4.0