CVE-2012-1936: CSRF
DISPUTED The wpcreatenonce function in wp-includes/pluggable.php in WordPress 3.3.1 and earlier associates a nonce with a user account instead of a user session, which might make it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks on specific actions and objects by sniffing the network, as demonstrated by attacks against the wp-admin/admin-ajax.php and wp-admin/user-new.php scripts. NOTE: the vendor reportedly disputes the significance of this issue because wpcreatenonce operates as intended, even if it is arguably inconsistent with certain CSRF protection details advocated by external organizations.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-1936?
CVE-2012-1936 is considered a medium severity vulnerability due to its potential to facilitate cross-site request forgery (CSRF) attacks.
How do I fix CVE-2012-1936?
To mitigate CVE-2012-1936, upgrade to a patched version of WordPress that is later than 3.3.1.
What software is affected by CVE-2012-1936?
CVE-2012-1936 affects WordPress versions 3.3.1 and earlier, along with several earlier versions.
What attacks can CVE-2012-1936 enable?
CVE-2012-1936 can enable remote attackers to conduct cross-site request forgery (CSRF) attacks on authenticated user actions.
Is CVE-2012-1936 still a risk if I have updated my WordPress?
If you have updated your WordPress to a version later than 3.3.1, the risk associated with CVE-2012-1936 should be mitigated.