{"cve":"CVE-2012-0937","nvd":{"published":"2012-01-30T17:55:01.330","modified":"2026-06-16T23:38:32.537","status":"Modified","description":"wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not limit the number of MySQL queries sent to external MySQL database servers, which allows remote attackers to use WordPress as a proxy for brute-force attacks or denial of service attacks via the dbhost parameter, a different vulnerability than CVE-2011-4898.  NOTE: the vendor disputes the significance of this issue because an incomplete WordPress installation might be present on the network for only a short time","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["http://archives.neohapsis.com/archives/bugtraq/2012-01/0150.html","http://www.exploit-db.com/exploits/18417","https://www.trustwave.com/spiderlabs/advisories/TWSL2012-002.txt","http://archives.neohapsis.com/archives/bugtraq/2012-01/0150.html","http://www.exploit-db.com/exploits/18417"],"products":["wordpress:wordpress"],"source":"nvd","synced_at":"2026-10-19T19:59:31.623151214+00:00"},"epss":{"cve":"CVE-2012-0937","score":0.07631,"percentile":0.94566,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}