| CVE-2012-1936 | Date: (C)2012-05-03 (M)2024-04-19 |
The wp_create_nonce function in wp-includes/pluggable.php in WordPress 3.3.1 and earlier associates a nonce with a user account instead of a user session, which might make it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks on specific actions and objects by sniffing the network, as demonstrated by attacks against the wp-admin/admin-ajax.php and wp-admin/user-new.php scripts. NOTE: the vendor reportedly disputes the significance of this issue because wp_create_nonce operates as intended, even if it is arguably inconsistent with certain CSRF protection details advocated by external organizations
CVSS Score and Metrics +CVSS Score and Metrics -| CVSS V2 Severity: |
| CVSS Score : 6.8 |
| Exploit Score: 8.6 |
| Impact Score: 6.4 |
| |
| CVSS V2 Metrics: |
| Access Vector: NETWORK |
| Access Complexity: MEDIUM |
| Authentication: NONE |
| Confidentiality: PARTIAL |
| Integrity: PARTIAL |
| Availability: PARTIAL |
| | |
