CVE-2012-0937: Medium severity wordpress vulnerability
DISPUTED wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not limit the number of MySQL queries sent to external MySQL database servers, which allows remote attackers to use WordPress as a proxy for brute-force attacks or denial of service attacks via the dbhost parameter, a different vulnerability than CVE-2011-4898. NOTE: the vendor disputes the significance of this issue because an incomplete WordPress installation might be present on the network for only a short time.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-0937?
The severity of CVE-2012-0937 is considered to be high due to its potential exploitation for brute-force and denial-of-service attacks.
How do I fix CVE-2012-0937?
To fix CVE-2012-0937, upgrade your WordPress installation to version 3.3.2 or later, where the vulnerability is patched.
Which versions of WordPress are affected by CVE-2012-0937?
CVE-2012-0937 affects WordPress versions 3.3.1 and earlier, as well as several legacy versions.
What type of attacks can exploit CVE-2012-0937?
CVE-2012-0937 can be exploited for brute-force attacks and denial-of-service attacks by allowing excessive MySQL queries.
Is there any workaround for CVE-2012-0937 before I can update?
While it is recommended to update, you may limit direct access to wp-admin/setup-config.php or restrict MySQL connections as a temporary measure.