UnratedFix available
wordpress — security advisory
WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to obtain access to an account idle since 2008 by leveraging an improper PHP dynamic type comparison for an MD5 hash.
- Products
- wordpress
- Affected versions
- Not specified
- Fixed versions
- 4.0.1+dfsg-1
- CVEs
- CVE-2014-9037
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 21:41 UTC · Revision 1
Source evidence
WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to obtain access to an account idle since 2008 by leveraging an improper PHP dynamic type comparison for an MD5 hash.
osv:DEBIAN-CVE-2014-9037
wordpress
Fixed versions: 4.0.1+dfsg-1
wordpress
Fixed versions: 4.0.1+dfsg-1
wordpress
Fixed versions: 4.0.1+dfsg-1
Complete source record
{
"id": "08e869e39b509281fe22917c80c7858a2fc8408632c0699b795f5409836f13ff",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2014-9037",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2014-9037",
"summary": "WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to obtain access to an account idle since 2008 by leveraging an improper PHP dynamic type comparison for an MD5 hash.",
"evidence": "osv:DEBIAN-CVE-2014-9037",
"products": [
{
"name": {
"value": "wordpress",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "4.0.1+dfsg-1",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "wordpress",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "4.0.1+dfsg-1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "wordpress",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "4.0.1+dfsg-1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "DEBIAN-CVE-2014-9037",
"aliases": [
"DEBIAN-CVE-2014-9037"
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "4.0.1+dfsg-1"
}
]
}
],
"package": {
"name": "wordpress",
"purl": "pkg:deb/debian/wordpress?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2014-9037.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "4.0.1+dfsg-1"
}
]
}
],
"package": {
"name": "wordpress",
"purl": "pkg:deb/debian/wordpress?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2014-9037.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "4.0.1+dfsg-1"
}
]
}
],
"package": {
"name": "wordpress",
"purl": "pkg:deb/debian/wordpress?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2014-9037.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
],
"modified": "2026-10-23T15:47:30.925606508Z",
"provider": "osv",
"upstream": [
"CVE-2014-9037"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2014-9037"
]
},
"related_cves": [
{
"value": "CVE-2014-9037",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 414107,
"published_at": "2014-11-25T23:59:08.193+00:00"
}