WordPress Vulnerabilities

WordPress <= 4.0 - Long Password Denial of Service (DoS)

Affects WordPress

3.8.1
Fixed in WordPress 4.0.1
3.8
Fixed in WordPress 4.0.1
3.7.1
Fixed in WordPress 4.0.1
3.6
Fixed in WordPress 4.0.1
3.5.2
Fixed in WordPress 4.0.1
3.5.1
Fixed in WordPress 4.0.1
3.5
Fixed in WordPress 4.0.1
3.4.2
Fixed in WordPress 4.0.1
3.4.1
Fixed in WordPress 4.0.1
3.4
Fixed in WordPress 4.0.1
3.3.3
Fixed in WordPress 4.0.1
3.3.2
Fixed in WordPress 4.0.1
3.3.1
Fixed in WordPress 4.0.1
3.3
Fixed in WordPress 4.0.1
3.2.1
Fixed in WordPress 4.0.1
3.2
Fixed in WordPress 4.0.1
3.1.4
Fixed in WordPress 4.0.1
3.1.3
Fixed in WordPress 4.0.1
3.1.2
Fixed in WordPress 4.0.1
3.1.1
Fixed in WordPress 4.0.1
3.1
Fixed in WordPress 4.0.1
3.0.6
Fixed in WordPress 4.0.1
3.0.5
Fixed in WordPress 4.0.1
3.0.4
Fixed in WordPress 4.0.1
3.0.3
Fixed in WordPress 4.0.1
3.0.2
Fixed in WordPress 4.0.1
3.0.1
Fixed in WordPress 4.0.1
3.0
Fixed in WordPress 4.0.1
2.9.2
Fixed in WordPress 4.0.1
2.9.1
Fixed in WordPress 4.0.1
2.9
Fixed in WordPress 4.0.1
2.8.6
Fixed in WordPress 4.0.1
2.8.5
Fixed in WordPress 4.0.1
2.8.4
Fixed in WordPress 4.0.1
2.8.3
Fixed in WordPress 4.0.1
2.8.2
Fixed in WordPress 4.0.1
2.8.1
Fixed in WordPress 4.0.1
2.8
Fixed in WordPress 4.0.1
2.7.1
Fixed in WordPress 4.0.1
2.7
Fixed in WordPress 4.0.1
2.6.5
Fixed in WordPress 4.0.1
2.6.3
Fixed in WordPress 4.0.1
2.6.2
Fixed in WordPress 4.0.1
2.6.1
Fixed in WordPress 4.0.1
2.6
Fixed in WordPress 4.0.1
2.5.1
Fixed in WordPress 4.0.1
2.5
Fixed in WordPress 4.0.1
2.3.3
Fixed in WordPress 4.0.1
2.3.2
Fixed in WordPress 4.0.1
2.3.1
Fixed in WordPress 4.0.1
2.3
Fixed in WordPress 4.0.1
2.2.3
Fixed in WordPress 4.0.1
2.2.2
Fixed in WordPress 4.0.1
2.2.1
Fixed in WordPress 4.0.1
2.2
Fixed in WordPress 4.0.1
2.1.3
Fixed in WordPress 4.0.1
2.1.2
Fixed in WordPress 4.0.1
2.1.1
Fixed in WordPress 4.0.1
2.1
Fixed in WordPress 4.0.1
2.0.11
Fixed in WordPress 4.0.1
2.0.10
Fixed in WordPress 4.0.1
2.0.9
Fixed in WordPress 4.0.1
2.0.8
Fixed in WordPress 4.0.1
2.0.7
Fixed in WordPress 4.0.1
2.0.6
Fixed in WordPress 4.0.1
2.0.5
Fixed in WordPress 4.0.1
2.0.4
Fixed in WordPress 4.0.1
2.0.3
Fixed in WordPress 4.0.1
2.0.2
Fixed in WordPress 4.0.1
2.0.1
Fixed in WordPress 4.0.1
2.0
Fixed in WordPress 4.0.1
1.5.2
Fixed in WordPress 4.0.1
1.5.1.3
Fixed in WordPress 4.0.1
1.5.1.2
Fixed in WordPress 4.0.1
1.5.1.1
Fixed in WordPress 4.0.1
1.5.1
Fixed in WordPress 4.0.1
1.5
Fixed in WordPress 4.0.1
3.6.1
Fixed in WordPress 4.0.1
3.9
Fixed in WordPress 4.0.1
3.9.1
Fixed in WordPress 4.0.1
3.7
Fixed in WordPress 4.0.1
3.8.2
Fixed in WordPress 4.0.1
3.8.3
Fixed in WordPress 4.0.1
3.9.2
Fixed in WordPress 4.0.1
4.0
Fixed in WordPress 4.0.1
1.2
Fixed in WordPress 4.0.1
1.2.1
Fixed in WordPress 4.0.1

References

CVE
CVE-2014-9034
Exploitdb
35413
Exploitdb
35414
URL
auxiliary/dos/http/wordpress_long_password_dos
URL
http://www.behindthefirewalls.com/2014/11/wordpress-denial-of-service-responsible-disclosure.html
URL
https://wordpress.org/news/2014/11/wordpress-4-0-1/

Miscellaneous

Submitter
ethicalhack3r
Submitter twitter
ethicalhack3r
Verified
Yes
WPVDB ID
aa6a0791-5d59-4c80-b943-bfec7fff7862

Timeline

Publicly Published
2014-11-20 (about 11 years ago)
Added
2014-11-20 (about 11 years ago)
Last Updated
2019-10-21 (about 6 years ago)

Other

Published
Title
Published
2022-07-11
Title
GiveWP < 2.21.3 - DoS via CSRF
Published
2023-12-05
Title
Code Embed < 2.3.7 - Authenticated(Contributor+) Denial of Service
Published
2024-12-12
Title
Minify HTML < 2.1.11 - - Regular Expressions Denial of Service
Published
2020-10-29
Title
WordPress < 5.5.2 - Unauthenticated DoS Attack to RCE
Published
2025-03-20
Title
WP-GeSHi-Highlight <= 1.4.3 - Author+ ReDoS